HA Configuration

[adamyau]

Hi All,

I just joined a new company. It has a Fortigate 80E with WAN1 and WAN2 connected  2 different ISP.  Some of the users have told me that they are having problem to access the CCTV and SSL VPN.   And I have found out that it should be the problem of the traffic flow.   Now all the outgoing traffic is forwarded to the WAN1(Primary) which is connected to ISP-A.  When users try to access the CCTV and SSLVPN from WAN2(Backup) which is connected to ISP-B, they cannot connect to the office.  But if I unplug the ISP-A connection, users can connect through ISP-B without problem.  So I think the reason is because the traffic from WAN2 goes out by WAN1.  

I got this problem before in a Fortigate 200A. It also had 2 ISPs connected to WAN1 and WAN2.  Finally a Engineer solved the problem by using a command in the console mode.  He told me that the command would tag the traffic from WAN2 and it would go out through WAN2 again instead of the WAN1(Primary).  

So anyone knows the command to solve this issue?

Thanks!

[Toshi_Esumi]

It's not any tagging and must be a priority on each static default route. There should be two default routes to both WAN1 and WAN2 in your routing table to go out to the internet and get back to random remote sources. When WAN1 side has a higher priority (lower number, likely using the default 0) and WAN2 side has a lower one, like 10, both default routes would be on the table like below:

xxx-fg2 (xxxxxx1) # get router info routing-t all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP        O - OSPF, IA - OSPF inter area        N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2        E1 - OSPF external type 1, E2 - OSPF external type 2        i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area        * - candidate default S*      0.0.0.0/0 [10/0] via 1.1.1.1, INTERFACE1                   [10/0] via 2.2.2.1, INTERFACE2, [10/0] As you can see above, the second default route has an additional [10/0] at the end. The '10' is the priority set on this static route like below:

config router static

    edit 2         set gateway 2.2.2.1         set priority 10         set device "INTERFACE2"     next end

FortiGate remembers the incoming access through WAN2 in the session table then routes returning and matching packets to the same interface as long as a route exists in the routing table toward the interface. But since the priority is low on the second interface, all new traffic/sessions initiated from inside would use the first interface.