Hot!Multiple WAN And VIP Routing

Author
saharhod
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/04/08 03:07:08
  • Status: offline
2019/04/08 03:18:19 (permalink)
0

Multiple WAN And VIP Routing

Hi, All.
I have a Fortigate 201E, with multiple WAN interfaces,
I am trying to change "Administrative Distance" on the static routes i have, so that some of the WAN interfaces are used more frequently than others.
Whenever I do that, VIP that is not pointed to the lowest "Administrative Distance" (or at least equal) will not work.
Do I have to use policy route?
Thank you
Sahar
#1

3 Replies Related Threads

    boneyard
    Gold Member
    • Total Posts : 124
    • Scores: 4
    • Reward points: 0
    • Joined: 2014/07/30 11:15:18
    • Status: offline
    Re: Multiple WAN And VIP Routing 2019/04/20 02:35:32 (permalink)
    0
    yeah, you can't and shouldn't use distance for that.
     
    if you want to spread traffic over multiple interfaces have a look what is currently called SD WAN
     
    https://cookbook.fortinet.com/redundant-internet-with-sd-wan-60/
    #2
    saharhod
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/04/08 03:07:08
    • Status: offline
    Re: Multiple WAN And VIP Routing 2019/04/21 02:02:56 (permalink)
    0
    Thank you for the reply,
    I am using SD-WAN interface as well, I have a lot of WAN interfaces not all are used in the SD-WAN.
    What I don't understand is how administrative distance influences VIP, and incoming traffic.
    I was trying to change distance to avoid using Policy Route, to use a specific outbound interface for a specific network.
    But I guess Policy Route is the way to go.
     
     
    #3
    boneyard
    Gold Member
    • Total Posts : 124
    • Scores: 4
    • Reward points: 0
    • Joined: 2014/07/30 11:15:18
    • Status: offline
    Re: Multiple WAN And VIP Routing 2019/04/22 00:23:07 (permalink)
    0
    saharhod
    What I don't understand is how administrative distance influences VIP, and incoming traffic.



    for incoming traffic the issue lies with the reverse path check, it is a feature that makes sure that traffic only enters on an interface it is expected.
     
    see https://kb.fortinet.com/kb/documentLink.do?externalID=FD30543
     
    when you have two routes towards the internet with different administrative distances then only one is in the routing table. which means that traffic on the other interface will be dropped because of the reverse path check as it compares the routing table with the traffic seen.
     
    so you need to keep the same administrative distance and different priorities to make this work for incoming traffic.
     
    for outgoing traffic you then use SD-WAN and perhaps policy routes, depending if you want to load balance outgoing traffic or determine what interface is used.
    #4
    Jump to:
    © 2019 APG vNext Commercial Version 5.5