how can i configure load ballancing between interfaces?

[#1]

Hi everyone, i' ve got fortigate 60 firewall in my office and thre are 3 adsl modems connected to it via dmz, wan1 and wan2. i just simply want some users or user groups access to internet via certain interfaces. let' s say that restricted user groups should access internet on wan1, free user groups or user should access internet via dmz or wan2... i' ve tried almost everyting but fortigate always balancing users between interfaces randomly. one day i access internet via dmz but other day via wan1 or wan2. what must i do to access internet always via same interface? any help would be greatly appreciated...

[rwpatterson]

Welcome to the forums What you should look towards is policy routing under ' Router > Static' . If you are able to split up the source traffic by subnet, interface (or any group the FGT can recognize), then you can ' bend' that traffic down and out any pipe you choose. Have a look at it, and give it a whirl. Good luck

[#3]

Thanks for your quick response rwpatterson, i believe i can make it by policy route. but it seems kinda complicated. i' m working on it. i' ll post the further information.

[#4]

Hi again Bob, i' ve added some policr routes, it worked fine till now. i can force port based web traffic on certain interfaces. it' s ok for now (which i actually want to force traffic based on ip addresses or subnets anyway). but there' s another situation happened when i added policy route. let me draw the picture: my company has 3 seperated buildings which connected to each other via frame relay connection. cisco routers connects 3 offices. our 3 subnets are like 192.168.0.0, 192.168.1.0 and 192.168.3.0. in this case i' ve got a static route in fortinet for internal connections (forcing lan connections to cisco router). since i added to policy route to force internet traffic, my internal static route doesn' t work anymore.. any suggestions??

[rwpatterson]

You have a very complicated setup it seems. Where is the Fortigate in relation to the Ciscos? Do the Ciscos simply terminate the serial ports, or are they routing as well? What firmware version are you currently running?

[#6]

Firmware version is 3.00,build8448,070409 let me explain how are ciscos way of work. we' ve got a main headquarter, other branch offices connecting main headquarter via frame relay connection by routing cisco routers. but branch offices doesn' t communicate by eacy other. i' ve got a static route which routes any single internal lan requests to the cisco router, than cisco router routes every lan requests to main headquarter. in this scenario my main problem is static route policy doesn' t work anymore if i add any policy based route. this means branch offices can' t connect to the main headquarter. if i delete policy route everything is ok. i hope i could make it more clear for you. thank you for your interest by the way.

[rwpatterson]

Does it look like the following: Site C Cisco     |     | main site Cisco-----FGT 60-----Internet     |     | Site B Cisco

[#8]

it looks like: site C FGT60---- internet Cisco | | (Cisco) main site FGT60---- internet | | Site B Cisco FGT60---- internet every office have it' s own FGT60. we don' t use AD by the way...

[rwpatterson]

OK, now that I have your complicated picture, tell me again how you are trying to split up traffic? Also, if you have Internet at each site, why bother with the Ciscos? The Fortigates are more than able to terminate the LAN and WAN connections without the added maintenance and overhead of the Ciscos...

[#10]

we use ciscos because every branch office must communicate with main headquarter. we' ve got several terminal servers and all of them located in main headquarter, branch offices using a software which installed on terminal servers. that' s why we need routers... basicly i' ve added a policy route which force every traffic to dmz for every ports (i' m just trying to understand route policy, that' s why i made a policy like that) and it worked fine. but what i needed most is force ip blocks or subnets to certain interfaces, we' ll solve it later i believe.. but the problem is as you knew my static route doesn' t worke anymore if i add any policy route. how can i keep working all of my routes at the same time? or why my static route stop working if i add any policy route?