forwarding traffic from 4G modem

[Turtle]

I have a Huawei B593s 4G modem that has option to send all incoming traffic to internal IP. I have set this to Fortigate 60B WAN1 interface. For some reason I can't get FG policy to work as needed, to forward traffic to virtual IP in the Fortigate internal network 172.16.0.0. I have created a virtual IP 192.168.1.2 --> 172.16.0.10 and firewall policy

Huawei 4G public ip = x.x.x.x

Huawei interal ip = 192.168.1.1

Fortigate 60B WAN1 ip = 192.168.1.2

Fortigate 60B INTERNAL ip = 172.16.0.1

FG60B # diag sniffer packet wan1 'src host x.x.x.x' 4 10

interfaces=[wan1]

filters=[src host x.x.x.x]

1.984688 wan1 -- x.x.x.x.21138 -> 192.168.1.2.3389: syn 541845839

13.304922 wan1 -- x.x.x.x.21165 -> 192.168.1.2.3389: syn 803328662

16.114616 wan1 -- x.x.x.x.21165 -> 192.168.1.2.3389: syn 803328662

22.089080 wan1 -- x.x.x.x.21165 -> 192.168.1.2.3389: syn 803328662

This 4G modem is a backup for my primary connection that is connected to WAN2. Any ideas how to get this to work?

[sw2090]

There is two ways you can do this:

one is to use the Virtual-WAN-Link (Loadbalancing) i.e. WLLB. The advantage of this is that you only need one WAN Policy per Subnet then. You could weight it to send all traffic over WAN2 and none over WAN1 and set some connectivity check. WLLB would then do fallback to WAN2 if the connectivity check(s) fail on WAN1. Here you will have to enter the ip of your modem as gateway for WAN2 in WLLB settings.

The other one is to have two default routes with either gateway. On the default router for WAN2 then the IP of your modem would be the gateway on the FGT.

This would require a policy for access to internet via WAN2 for every subnet/object each andit also would require some way to tell the FGT when to use which one. The easiest way here would be the order of the policies with the disadvantage that you would not have automatic fallover then.

So I'd say the most elegant way in my opinion is the first one i mentioned. Do it with WLLB, have connectivty check(s) and only one WAN Policy per net.

hth

Sebastian