Same Portforwarding over 2 WANs

[dzajac]

I am using a Fortigate in NAT mode.

The firewall has two WAN (1x Fibre, 1xVDSL).

Both connections are working and now I want to have incoming NAT on both WANs to the same Server.

Routing is configured with both static routes with the same priority and same distance.

The rules are working. But only one at a time. If both are enabled, only one is working. If I disable one rule the other works o.k.

But if both are enabled, the traffic always seems to be answered over the VDSL not the incomming interface. So the Firbre NAT stops working as soon as both rules are enabled.

The NAT on the Fibre line is using and additional IP not the WAN on that interface.

Policy routing is not enabled yet.

Goal is to have the server answering on the same interface for the two NAT rules, that was used inbound.

[lobstercreed]

Please provide more detail regarding your policy config.  It sounds like you have two different VIP objects with two different policies (since you mention enabling one and then the other?).  If you've setup a zone (or SD-WAN) for your two Internet connections, you could have them on one policy, but that shouldn't make any difference. 

It sounds to me like it should work the way you're describing as long as it passes RPF check (and it sounds like it would since you said both static routes have the same priority and distance).  I wonder if you have something goofy in your VIP config, so maybe show that config as well please.  Feel free to obfuscate IPs as long as it is clear what goes where.

[maredcz]

I had similar issue with 6.2.3 on FG60E. The back route was not cached and response was routed depending on routing table. So if the wan1 has the route with higher priority, the request coming to wan2 is forwarded to vip destination, and the response is going thru wan1. This behaviour was active when in system settings was asymroute enabled or the new 6.2.3 feature "auxiliary-session" enabled. The asymroute feature deactivates the reverse path route caching.