Hot!LAN users to WAN1 and Wifi to WAN2

Author
flybelgium
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/08/26 23:58:34
  • Status: offline
2018/08/27 00:16:01 (permalink)
0

LAN users to WAN1 and Wifi to WAN2

Hello,
 
I have a Fortigate 100E and i would like to route internet traffic to 2 differents WAN.
Actually, i have made this configuration and... not working :
1. In interfaces, i have my 2 WANS configured with the ISP ip config
2. In Static Routes, i have my 2 WANS configured with the gateway of my ISP.
First with distance 10 and WAN 2 with distance 20.
3. In IPV4 Policy i have basicaly 2 policies :
--> 1 All LAN traffic to WAN1 source all - destination all with AV, Web Filter and AppControl and SSL Inspection.
--> 2 LAN Traffic with in source 2 Locales IP only 192.168.100.10 + 192.168.100.11> destination All to WAN 2
At this point all the traffic go to WAN1...
I have made a policy to DENY 192.168.100.10 and 192.168.100.11 to WAN1
At this point, this two ips are not working... no WAN traffic, in traceroute i dont have any responses, local network ok, no outgoing traffic to WAN2 or WAN1.
 
Important, WAN1 traffic go to CISCO Router and WAN2 Traffic is a cable modem in bridged mode.
I just would like to route selected IP to WAN2 and the rest to WAN1, like servers to wan1 and users to wan2.
Any idea ?
Thanks in advance.
#1

10 Replies Related Threads

    tanr
    Platinum Member
    • Total Posts : 639
    • Scores: 21
    • Reward points: 0
    • Joined: 2016/05/09 17:09:43
    • Status: offline
    Re: LAN users to WAN1 and Wifi to WAN2 2018/08/27 07:36:49 (permalink)
    5 (1)
    Your static routes need to have the same distances, but different priorities, that way they will both stay in the routing table, but the route with the higher priority (lower number) will be used by default.
     
    So, say you have created the route to WAN1 with the higher priority.
    Create a policy route with, your WiFi users as the source, and specify WAN2 as the outgoing interface. 
    The policy route will find the other route in your routing table and use it.
    #2
    flybelgium
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/26 23:58:34
    • Status: offline
    Re: LAN users to WAN1 and Wifi to WAN2 2018/08/27 07:53:43 (permalink)
    0
    tanr
    Your static routes need to have the same distances, but different priorities, that way they will both stay in the routing table, but the route with the higher priority (lower number) will be used by default.
     
    So, say you have created the route to WAN1 with the higher priority.
    Create a policy route with, your WiFi users as the source, and specify WAN2 as the outgoing interface. 
    The policy route will find the other route in your routing table and use it.




    Thanks tanr.
    In my tests, i have deleted my static route to WAN2 and now, i cannot add a static route...
    Destination
    0.0.0.0/0.0.0.0
    Gateway = ISP Gateway of WAN2 (for example 2.2.2.2)
    Interface WAN2
    Administrative Distance = 10
    Priority = 10
    I have this error :

    Error

    A duplicate entry already exists.

    I just have only one static route to WAN1
    Destination
    0.0.0.0/0.0.0.0
    Gateway = ISP Gateway (1.1.1.1)
    Interface WAN1
    Administrative Distance = 10
    Priority = 5


    If i look to routing monitor, i see a connected route to my WAN2... i dont find where is this connected route ?

    Thanks in advance
    post edited by flybelgium - 2018/08/27 07:57:59
    #3
    flybelgium
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/26 23:58:34
    • Status: offline
    Re: LAN users to WAN1 and Wifi to WAN2 2018/08/28 01:06:46 (permalink)
    0
    I have found my error, it was on IP POOL, i have made a ip config for testing purpose in this menu... deleted and ok.

    At this time, i have added a second static route with ISP Gateway
    WAN 1
    Destination
    0.0.0.0/0.0.0.0
    Gateway = ISP Gateway of WAN1 (for example 1.1.1.1)
    Interface WAN2
    Administrative Distance = 10
    Priority = 10

    WAN 2
    Destination
    0.0.0.0/0.0.0.0
    Gateway = ISP Gateway of WAN2 (for example 2.2.2.2)
    Interface WAN2
    Administrative Distance = 10
    Priority = 5
     
    I have made a policy for just my ip go to WAN2 for testing...
    Not to bad... when i made traceroute, i can see my WAN2 after the fortigate but... all users on LAN interface
    doesnt have WAN access to WAN1... strange... i think LAN users go through WAN2... 
    This is "not possible"... i dont have any rules to forward internet traffic to WAN2, only my rule with my ip :

    Incoming : LAN interface
    Outgoing : WAN2
    Source : My Ip created in Adresses (my ip is in the lan interface range)
    Destination : All
    Service : All
    and NAT activated.
     
    I dont understand...
    Thanks in advance for help.
     
     
    #4
    tanr
    Platinum Member
    • Total Posts : 639
    • Scores: 21
    • Reward points: 0
    • Joined: 2016/05/09 17:09:43
    • Status: offline
    Re: LAN users to WAN1 and Wifi to WAN2 2018/08/28 07:34:09 (permalink)
    0
    Priority 5 is considered "higher" than priority 10, so you've made WAN2 the higher priority route.
    Just switch the priority values in your static routes.
    #5
    flybelgium
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/08/26 23:58:34
    • Status: offline
    Re: LAN users to WAN1 and Wifi to WAN2 2018/08/29 02:13:30 (permalink)
    0
    tanr
    Priority 5 is considered "higher" than priority 10, so you've made WAN2 the higher priority route.
    Just switch the priority values in your static routes.



    Thank you, i have understand 10 is higher than 5 ... sorry :)
    When i made 5 priority to WAN2 and 10 to WAN1 all users doesnt have access to internet through 2 wans.
    For me, this is a DNS problem, i can ping everything oustide, just resolution not working,
    but i dont know if is on the firewall or my network... ?
    I have a DNS Server in my domain, i have added the 2 DNS Servers of my ISP in the server.
    If i add 8.8.8.8 on my local network card > i can surf through WAN2
    If i apply DHCP on my network card > i cannot surf on WAN2

    I have apply two differents things for testing :
    - My computer with a RJ45 Network (with Domain) > not working on WAN2
    - Wifi Users with policy to go outside on WAN2 > OK Working
    >> in my firewall, Wifi Users are configured with own DHCP Server directy on SSID Profile with 8.8.8.8 for DNS.

    If i made a simple network map :
    My Local Computer >> Local DNS Domain >> Fortigate Firewall > Outside WAN1 or WAN2
    #6
    tanr
    Platinum Member
    • Total Posts : 639
    • Scores: 21
    • Reward points: 0
    • Joined: 2016/05/09 17:09:43
    • Status: offline
    Re: LAN users to WAN1 and Wifi to WAN2 2018/08/29 07:38:01 (permalink)
    0
    If you can ping out from your wired network, and traceroute shows you going the proper route, then yes it sounds like just a DNS issue.  That is, assuming you have all the security policies in place to allow basic outbound traffic.
     
    Does your local computer have the correct IP for your internal DNS server?  Does the FortiGate have security policies to let your internal DNS server access public DNS servers?
    #7
    rwpatterson
    Expert Member
    • Total Posts : 8302
    • Scores: 181
    • Reward points: 0
    • Joined: 2006/08/08 10:08:18
    • Location: Long Island, New York, USA
    • Status: offline
    Re: LAN users to WAN1 and Wifi to WAN2 2018/08/29 12:00:56 (permalink)
    0
    DNS is funny. If you try to resolve on one ISP's network using another's DNS servers, it may not work. Try a neutral server like (blech) Google @ 8.8.8.8/8.8.4.4 or one of the Level3 boxes 4.2.2.[1-6], and see if results are different.

    -Bob - self proclaimed posting junkie!
    See my Fortigate related scripts at: http://fortigate.camerabob.com

    -4.3.19-b0694
    FWF60B
    FWF80CM (4)
    FWF81CM (2)
     
    #8
    fslomka
    New Member
    • Total Posts : 3
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/09/03 05:29:55
    • Status: offline
    Re: LAN users to WAN1 and Wifi to WAN2 2018/09/03 06:46:10 (permalink)
    0
    What about using the SD-WAN feature?
    Give WAN1 a priority of 254 and WAN2 a priority of 1
    Then create a custom rule to pass certain traffic(ips) through WAN2
    #9
    pawanrohilla1984
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/10/08 10:11:42
    • Status: offline
    Re: LAN users to WAN1 and Wifi to WAN2 2018/10/11 17:35:50 (permalink)
    0
    hi is it working now?
     
    #10
    sw2090
    Gold Member
    • Total Posts : 247
    • Scores: 8
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Location: Regensburg
    • Status: offline
    Re: LAN users to WAN1 and Wifi to WAN2 2018/10/15 00:16:26 (permalink)
    0
    Basically:
     
    if you set your policies in the order you wrote them down here all traffic will alwys match the first and go to wan1. The second in this case will never ever match since policies are always exempt in fortios.
     
    (2) must be the first policy to match those two ip.
    (1) comes behind that and matches the rest of the subnet.
    #11
    Jump to:
    © 2018 APG vNext Commercial Version 5.5