Hot!SD-WAN and NAT with IP-Pool

Author
tobisfr
New Member
  • Total Posts : 10
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/02/22 04:27:42
  • Status: offline
2020/02/04 06:20:26 (permalink)
0

SD-WAN and NAT with IP-Pool

Hi,
i have two WAN interfaces (two different ISPs) configured as SD-WAN
WAN1: with 4 external IPs
WAN2: simple Gateway with 1 external IP
 
I wan't our FortiMail appliance to use both WAN interface for outgoing SMTP connections ( WAN2 if WAN1 is down). But how can i configure that it uses only 1 of the 4 IPs with WAN1?
 
(latest 5.6 FortiOS)
 
Thanks in advance,
Tobi
#1
AdiMizil
New Member
  • Total Posts : 16
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/12/28 13:01:17
  • Status: offline
Re: SD-WAN and NAT with IP-Pool 2020/02/05 05:07:15 (permalink)
0
HI tobisfr,
 
Please provide more info re FortiMail deployment . Gateway mode deployment : in front of firewall, behind firewall or in a DMZ  ?
https://s3.amazonaws.com/fortinetweb/docs.fortinet.com/v2/attachments/f7766de2-243a-11e9-b20a-f8bc1258b856/fortimail-admin-540.pdf  - page 46
 
A screen shoot of the Ipv4 policy for internet access for the FortiMail appliance  and one from the SD-WAN rules ( if it exists)- from the Fortigate unit
 
Then we can discuss about SD-WAN , DNS records for MX, SPF etc. 
 
Kind regards,
Adi
 
 
post edited by AdiMizil - 2020/02/05 05:19:19
#2
tobisfr
New Member
  • Total Posts : 10
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/02/22 04:27:42
  • Status: offline
Re: SD-WAN and NAT with IP-Pool 2020/02/06 05:04:12 (permalink)
0
Hi,
 
the FortiMail is behind the Firewall
- MX-Record Pointing to one A-Record
- A-Record Pointing to the two external IP-Adresses of our ISPs
- PTR Records on this IPs set to A-Record
 
Receiving Mail works fine with the two WAN interfaces ( Set
 
At the moment I only use WAN1 to send external Mail:
- In the policy I do NAT with IPPool Mode one-to-one
- Set a Policy Route with source "Fortimail" und Port 25 to use WAN1
 
No I don't now how to configure both WAN Interfaces the send with the correct NAT-Adress.
 
 
 
#3
AdiMizil
New Member
  • Total Posts : 16
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/12/28 13:01:17
  • Status: offline
Re: SD-WAN and NAT with IP-Pool 2020/02/13 00:30:15 (permalink)
0
I would try like that :
 
Create another IP Pool with the other public IP address from WAN2 (I don't know if One to One type will break current internet access for WAN2, I would also try also with Overload)
Change outgoing interface from WAN1 to SD-WAN in IPv4 policy
Set Dynamic IP POOL with both IP POOLS created.
 
MOVE this rule above existing IPv4 internet access rules so this will get hit first . 
 
TEST the rule and test the internet access for the company.
 
for testing you can try this on cli 
 
diagnose sniffer  packet  wan2 "tcp and port 25" 4
or
diagnose sniffer packet "tcp and port 25" 4    - for all interfaces
or
diagnose sniffer packet wan1 wan2 "tcp and port 25" 4
 
 
There is another option for SD-WAN , search on youtube "SD-WAN Rule Improvement: Load Balancing | FortiOS 6.2 " - but you don't have control over which interface traffic goes as this relies more on SLA's. It worth checking.  
 
P.S. - update public DNS records , SPF record to white list all your PUBLIC IP addresses from WAN 1 and WAN2 . 
 
Kind regards, 
Adi
#4
Jump to:
© 2020 APG vNext Commercial Version 5.5