Hot!ask - Load Balancing in 1 way

Author
papapuff
Silver Member
  • Total Posts : 102
  • Scores: 0
  • Reward points: 0
  • Joined: 2012/05/24 20:31:44
  • Status: offline
2018/11/20 06:19:43 (permalink)
0

ask - Load Balancing in 1 way

hi there,
 
we use FG 60D, with firmware 6.0 (forget built version).
we have 2 WAN connection. WAN1 for internet connection Port 1, and WAN2 for internet connection port 7.
DDNS and VPN listening on WAN2.
 
Now, want to make:
1. whenever WAN2 down, port 7 use internet from WAN1, but not vice versa.
2. DDNS and VPN listening on WAN2, but whenever WAN2 down, DDNS and VPN listening on WAN1.
we use VPN IPSEC and VPN SSL.
 
please help. thank you
#1

6 Replies Related Threads

    papapuff
    Silver Member
    • Total Posts : 102
    • Scores: 0
    • Reward points: 0
    • Joined: 2012/05/24 20:31:44
    • Status: offline
    Re: ask - Load Balancing in 1 way 2018/12/06 01:58:01 (permalink)
    0
    help please..
     
    is it possible to do that?
     
    #2
    echo
    Silver Member
    • Total Posts : 92
    • Scores: 4
    • Reward points: 0
    • Joined: 2013/06/19 07:45:28
    • Location: Tallinn, Estonia
    • Status: offline
    Re: ask - Load Balancing in 1 way 2018/12/06 02:27:48 (permalink)
    3 (1)
    I imagine that you should use vdoms, vdom1 includes wan1+port1, vdom2 includes wan2+port7. And then in vdom2 you make an additional routing with higher distance number that 0.0.0.0/0 goes out through vdom1. This may require inter-vdom links (as certain interfaces). I don't know about 60D if that model has this possibility. For the second point, it is simpler to keep both open and working, otherwise you should manually activate the services on wan1. Just these general notes to try, I haven't made this specific setup by myself though. Probably I miss something regarding DDNS specific or its requirements or setup.
    post edited by echo - 2018/12/06 02:32:25
    #3
    lobstercreed
    Bronze Member
    • Total Posts : 33
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/11/28 14:57:58
    • Location: Sedalia, MO
    • Status: offline
    Re: ask - Load Balancing in 1 way 2018/12/06 12:34:02 (permalink)
    0
    I am unfamiliar with DDNS but I don't think you need VDOMs to do this.  However, I believe the VPN will need to be accessible via either WAN all the time if you want it to work.  The rest should be possible via policy routing and multiple static routes with different metrics like echo mentioned.
    #4
    papapuff
    Silver Member
    • Total Posts : 102
    • Scores: 0
    • Reward points: 0
    • Joined: 2012/05/24 20:31:44
    • Status: offline
    Re: ask - Load Balancing in 1 way 2018/12/06 17:40:40 (permalink)
    0
    hi.
    what is VDOMs? sorry for silly questions.
     
    I search on internet, if I want to configure load balancing, then first I need to delete all policy, static route related to those WAN connections. is this correct?
    #5
    lobstercreed
    Bronze Member
    • Total Posts : 33
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/11/28 14:57:58
    • Location: Sedalia, MO
    • Status: offline
    Re: ask - Load Balancing in 1 way 2018/12/07 01:12:19 (permalink)
    0
    I recommend reading the manual about VDOMs.  Here are a couple links to get you started:
    https://cookbook.fortinet.com/vdom-configuration/
    https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-virtual-domains-54/1-VDOM-overview/1-Introduction.htm
     
    Load balancing is a new topic.  Do you want to load balance (i.e. balance all traffic between the WANs all the time) or do you want to do what you first described in your post (make sure certain traffic goes one way while other traffic goes another and fail over only if one is down)?
    #6
    echo
    Silver Member
    • Total Posts : 92
    • Scores: 4
    • Reward points: 0
    • Joined: 2013/06/19 07:45:28
    • Location: Tallinn, Estonia
    • Status: offline
    Re: ask - Load Balancing in 1 way 2018/12/07 01:26:47 (permalink)
    0
    I think the VDOMs are necessary, if the failover has to be only one way as the initial requirement was. But if the same can be realised with policy based routes... Maybe. Would be simpler.
    #7
    Jump to:
    © 2018 APG vNext Commercial Version 5.5