I have a Huawei B593s 4G modem that has option to send all incoming traffic to internal IP. I have set this to Fortigate 60B WAN1 interface. For some reason I can't get FG policy to work as needed, to forward traffic to virtual IP in the Fortigate internal network 172.16.0.0. I have created a virtual IP 192.168.1.2 --> 172.16.0.10 and firewall policy
one is to use the Virtual-WAN-Link (Loadbalancing) i.e. WLLB. The advantage of this is that you only need one WAN Policy per Subnet then. You could weight it to send all traffic over WAN2 and none over WAN1 and set some connectivity check. WLLB would then do fallback to WAN2 if the connectivity check(s) fail on WAN1. Here you will have to enter the ip of your modem as gateway for WAN2 in WLLB settings.
The other one is to have two default routes with either gateway. On the default router for WAN2 then the IP of your modem would be the gateway on the FGT.
This would require a policy for access to internet via WAN2 for every subnet/object each andit also would require some way to tell the FGT when to use which one. The easiest way here would be the order of the policies with the disadvantage that you would not have automatic fallover then.
So I'd say the most elegant way in my opinion is the first one i mentioned. Do it with WLLB, have connectivty check(s) and only one WAN Policy per net.
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.