Two internets configuration

[Ali_Has]

Firmware: v6.4.9 build1966 (GA)
Firewall: Fortigate-40F

I need to connect two ISPs in firewall. I want to use these two ISPs separately. Means ISP1 will only work with 8/10 computers (according to my choice) and ISP2 with 10computers or more  both ISPs have their own switch (unmanaged) that is, sw1 and sw2. Whichever ISP I want to use I have to connect with that switch. Its not possible for me to give mix ISPs to PCs or servers (sometime ISP 1 and sometime ISP2)

I have configured like this:
Internet1 (WAN) to lan1
Internet2 (lan3) to lan2
Both internet interfaces are in DHCP mode and both LAN interfaces are in manual mode with "DHCP server" ON for assigning address range. I have created two static routes for two internets. Two separate policies (internet1 to lan1 and internet2 to lan2).

The problem I am facing is only one internet is working at a time. What I have noticed is two static routes (Internet1 & internet2) is creating issue. If disable one static route, internet which static route is enabled start working same with the other internet.

[ede_pfau]

This is doable but will require a bit of configuration.

Reason: there is only one default route per system (=FGT or VDOM).

A static route is followed by looking at the destination address only. A default route uses a wildcard '0.0.0.0' as destination address, so if you had 2 of this kind the FGT would not know which one to follow.

Solutions in brief:

1- create a VDOM for the second set of hosts. You already separate LAN and WAN ports, so why not go the full way and separate the firewall as well. Then, you will have 2 (virtual) FGTs in one hardware, with routing, addresses, interfaces, policies etc.

2- alternatively, you could use a policy route to direct traffic from the second LAN to the second ISP. With policy routes, there are more criteria which can determine a match, such as source address.

In addition to a policy route, you will need to establish 2 default routes in the routing table. Otherwise, the FGT will drop traffic coming back from ISP2 (RPF check). You do so by assigning the same distance, but different priorities to 2 static default routes. Priority is a CLI only parameter. In FortiOS, 'priority' translates to 'cost', so the route with lower priority value will be the one active default route, and the other will show up in the Routing monitor but will not be used actively.

So, active default route to ISP1, and policy route and passive default route to ISP2.

IMHO splitting the firewall into 2 would be clean and be modeling the reality but YMMV.

[parteeksharma · Accepted solution]

Hi Ali,

You can send the certain user traffic to another ISP by creating a policy route for the source IP subnet and the protocol based on your requirment and the "action" should be "Forward traffic" and outgoing interface should be the WAN interface of 2nd ISP.
Also the security policy should be created to allow the traffic for the user to flow through 2nd ISP.

[Ali_Has]

@parteeksharma by security policy u mean "firewall policy" ?I mean normal policies which we have configured for interfaces ?

[parteeksharma]

Yes, the firewall policies should also be created to allow the traffic to flow through other ISP.