Hot!ImPossible to use Fortigate as Load Balancer ? - Two ISP VirtualIP to same Internal server

Author
rickywong
New Member
  • Total Posts : 10
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/12/20 23:09:31
  • Status: offline
2020/03/21 09:36:15 (permalink)
0

ImPossible to use Fortigate as Load Balancer ? - Two ISP VirtualIP to same Internal server

Hi all,


I know Fortigate supports LB for single ISP to multiple Web servers...
No need to tell me again. I don't want this.

 
I am studying Fortigate 6.0.6, DNAT and SDWAN whether able to perform the inbound traffic load balancing over two ISPs.
 
Let have a look at my Virtual IP configurations:
 
edit "Test1"
set extintf "wan1"
set portforward enable
set mappedip "192.168.1.106"
set extport 80
set mappedport 80
next

edit "Test2"
set extintf "wan2"
set portforward enable
set mappedip "192.168.1.106"
set extport 80
set mappedport 80
next

Both Wan1 and 2 are DHCP with external DDNS working well.

And are in SDWAN group already:

config system virtual-wan-link
set status enable
set load-balance-mode source-dest-ip-based
config members
edit 1
set interface "wan1"
next
edit 2
set interface "wan2"
next
end

 
Well, then I run a test from the Internet to wan2 to trigger the incoming traffic.
I find that about 50% chance the incoming does come from wan2, but the return traffic is to wan1.....
Or, Vice Versa.
 
The

dia sni pac any "host MyTestDeviceSrcIpFromInternetToMyWan2"

does appear:
 
Wan2 in : MyTestDeviceSrcIpFromInternetToMyWan2 -> Wan2:80
DMZ Out : MyTestDeviceSrcIpFromInternetToMyWan2 -> 192.168.1.106:80
DMZ In : 192.168.1.106:80 -> MyTestDeviceSrcIpFromInternetToMyWan2
Wan1 Out : Wan2 Interface IP as Src IP :80 -> MyTestDeviceSrcIpFromInternetToMyWan2 

Obviously wrong route interface in the final step ....
How does my Wan1 ISP accept the Wan2 Src IP traffic?
Of course not and get a drop!

The only way for me to make it able to in/out from wan2 is to have a SDWAN rule to force the server use WAN2.
But this just stop me using the Wan1 for the same server incoming traffic at the same time.
 
Any solution?
#1
lobstercreed
Gold Member
  • Total Posts : 162
  • Scores: 21
  • Reward points: 0
  • Joined: 2018/11/28 14:57:58
  • Location: Sedalia, MO
  • Status: offline
Re: ImPossible to use Fortigate as Load Balancer ? - Two ISP VirtualIP to same Internal se 2020/03/22 23:55:16 (permalink)
0
Hmm, this sounds like it could be a bug to me, but I have three ideas that you could test independently to see what works. 
 
  1. What happens if you set the nat-source-vip for each object to enable?
  2. I would disable port-forwarding for these VIPs unless you have other services listening on your public IPs. Your policy from sdwan -> dmz should be used to restrict what ports the outside world can connect on.  Port forwarding is only desirable when multiple services need to be hosted on the same IP or when a non-standard port is used on one side or the other.
  3. What if you actually set the extip to the addresses your ISP has given you?  I understand they're subject to change but it would be good to see if that's the issue...I found an article from very old code that shows you being on the right track, but the extip was set: https://kb.fortinet.com/kb/documentLink.do?externalID=FD30903
 
Also, I would note that your title is misleading as it's not really load-balancing in any sense since you're pointing to one server...load-balancing is a separate feature that I assume you know about based on your comment at the beginning.
#2
rickywong
New Member
  • Total Posts : 10
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/12/20 23:09:31
  • Status: offline
Re: ImPossible to use Fortigate as Load Balancer ? - Two ISP VirtualIP to same Internal se 2020/03/24 07:17:19 (permalink)
0
lobstercreed
Hmm, this sounds like it could be a bug to me, but I have three ideas that you could test independently to see what works. 
 
  1. What happens if you set the nat-source-vip for each object to enable?
  2. I would disable port-forwarding for these VIPs unless you have other services listening on your public IPs. Your policy from sdwan -> dmz should be used to restrict what ports the outside world can connect on.  Port forwarding is only desirable when multiple services need to be hosted on the same IP or when a non-standard port is used on one side or the other.
  3. What if you actually set the extip to the addresses your ISP has given you?  I understand they're subject to change but it would be good to see if that's the issue...I found an article from very old code that shows you being on the right track, but the extip was set: https://kb.fortinet.com/kb/documentLink.do?externalID=FD30903
 
Also, I would note that your title is misleading as it's not really load-balancing in any sense since you're pointing to one server...load-balancing is a separate feature that I assume you know about based on your comment at the beginning.




1. Might I have more details and operation theory on the "nat-source-vip"? Can I server still able to see the source IP from the real WAN IP address but not the Fortigate?

2&3. Well, actually in my case, I have two static Real WAN mapping IP to one server for public access..

For your mentioned "Load-Balancing", ~ well. In my opinion, actually, I have a domain A record mapped with two WAN IP addresses already. But No going to discuss how to handle if one of the wan link down then what is going gon first. So, might be a little LB from WAN to it, I think?

Anyway, thanks for your help.
#3
rickywong
New Member
  • Total Posts : 10
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/12/20 23:09:31
  • Status: offline
Re: ImPossible to use Fortigate as Load Balancer ? - Two ISP VirtualIP to same Internal se 2020/03/26 10:17:45 (permalink)
0
lobstercreed
Hmm, this sounds like it could be a bug to me, but I have three ideas that you could test independently to see what works. 
 
  1. What happens if you set the nat-source-vip for each object to enable?
  2. I would disable port-forwarding for these VIPs unless you have other services listening on your public IPs. Your policy from sdwan -> dmz should be used to restrict what ports the outside world can connect on.  Port forwarding is only desirable when multiple services need to be hosted on the same IP or when a non-standard port is used on one side or the other.
  3. What if you actually set the extip to the addresses your ISP has given you?  I understand they're subject to change but it would be good to see if that's the issue...I found an article from very old code that shows you being on the right track, but the extip was set: https://kb.fortinet.com/kb/documentLink.do?externalID=FD30903
 
Also, I would note that your title is misleading as it's not really load-balancing in any sense since you're pointing to one server...load-balancing is a separate feature that I assume you know about based on your comment at the beginning.




 
nat-source-vip >>> SAME ISSUE
#4
Jump to:
© 2020 APG vNext Commercial Version 5.5