Fortigate with 2 WAN over private ip

[sesamiv]

Hello everyone,

I am a bit new to Fortigate and I wanted to ask you a question about the operation of the traffic generated by the FW itself.

Let me tell you about the case. I have a 200F with two WAN connections, the connection_1 with a public IP and the connection_2 with a public IP over a private IP with VLAN.

WAN 1 -> IP_PUBLIC_1
WAN 2 -> IP_PUBLIC_2 on PRIVATE_IP

When I configure WAN 1 as default route everything works correctly, Forticloud and Fortiguard update.
On the other hand, when I configure WAN 2 as default route I cannot reach these services because it will try to access through the PRIVATE_IP and it is not accessible from the Internet. After configuring the different services with the IP_PUBLIC_2 in "source-ip" if they are accessible.

The code we use for the "source-ip":
-------------------
config system fortiguard
set source-ip IP_PUBLIC_2
next

config system ntp
set source-ip IP_PUBLICA_2
next
-------------------

My question: In case of configuring the two WANs in a SD-WAN, the Fortiguard services will ONLY be accessible when the default route is WAN 1, being the "source-ip" of the services 0.0.0.0.0/0. Is this possible?

Best regards and thank you very much for your help!

[kmohan]

Hi Sesamiv.

Gd day

 In case of configuring the two WANs in a SD-WAN, the Fortiguard services will ONLY be accessible when the default route is WAN 1, being the "source-ip" of the services 0.0.0.0.0/0. Is this possible?

You can specify with interface on the fortiguard setting 

check with the below command line:

#config system fortiguard

# set interface-select-method specify
# set interface port4
# end

[kmohan]

Port4 ----> you use WAN1

[sesamiv]

Hi Kmohan,

thanks for your promptness.

In that case, if WAN 1 failed the FW would not be able to connect to Fortiguard, no?

Although thinking about it... either if WAN 1 fails or if it is not configured as you said, the FW would not be able to reach Fortiguard...

Thank you very much for the help, I will do as you said.

Best regards!