Hot!Add ISP to WAN2 (FortiGate 60E)

Author
mdnoor
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/12/16 00:18:49
  • Status: offline
2020/12/16 00:35:02 (permalink)
0

Add ISP to WAN2 (FortiGate 60E)

Hi all,
 
im new in fortigate currently we use fortigate 60e and inside already config use wan1 from ISP setup by previous people, now the company just purchase new ISP from different ISP which is i need to add at WAN2 but after i follow the cookbook config i unable to connect the internet for wan2. can some one help me how can i config wan2?
 
in picture i already remove back the config
 
reference basic config:
https://docs.fortinet.com...ecting-network-devices
 

Attached Image(s)

#1

11 Replies Related Threads

    Markus
    Expert Member
    • Total Posts : 286
    • Scores: 59
    • Reward points: 0
    • Joined: 2015/03/19 07:30:23
    • Location: Switzerland
    • Status: offline
    Re: Add ISP to WAN2 (FortiGate 60E) 2020/12/16 01:58:22 (permalink)
    5 (1)
    Hi, and welcome to the forums

    You have to configure Wan2 accordingly to your new ISP settings (IP, Subnet) and you have to change the default route to the new (ISP) gateway. But be carefull, this will break your wan1 internet access and any policy that is going to wan1.
    What is the plan, to use both ISPs in the future? If so, maybe SD-WAN https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/19246/sd-wan is an option for you. Anyhow, you have to change the config and policies anyway.

    For testing wan2 after you have setting up correctly, you can configure a route to a specific URi or host, let's say google.ch, make a policy and check if you can reach. For smooth migration, you can copy paste all the policies going to wan1 and change them to wan2 (having all then twice -> internal -> wan1 | internal -> wan2). Then you change the default route. If anything is working fine over wan2, you can delete the wan1 policies. Otherwise you change back the default route and you are fast back with internet access.
    You can also save a config backup and change all wan1 policies to wan2 with a text editor and upload the config. But this is not the best way if your box is in production. It will reboot the box and if there is some mistake, you probaly will break the access and/or your inet access.
    post edited by Markus - 2020/12/16 02:01:28
    #2
    mdnoor
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/12/16 00:18:49
    • Status: offline
    Re: Add ISP to WAN2 (FortiGate 60E) 2020/12/16 18:08:23 (permalink)
    0
    hi thanks for reply so to compromise ur explanation that means i need to do like this
     
    after i finish this step
    https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/428376/configuring-interfaces
     
    all the thing i need to do is routing and policy setting, and for internal setting is internal LAN right must create and assign ip for both diffrent ip?
    INTERNAL -> WAN1
    INTERNAL -> WAN2
     
    after finish testing both connection then only i can start config for redundancy right?
     
    Regards & Thanks
    #3
    mdnoor
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/12/16 00:18:49
    • Status: offline
    Re: Add ISP to WAN2 (FortiGate 60E) 2020/12/16 21:11:45 (permalink)
    0
    hai markus.
     
    do i have to create internal lan for wan2 also ?
     
    as i test using wan2 using internal port lan1&2 which is previous setup from another isp(wan1) can get internet.
     
    #4
    Markus
    Expert Member
    • Total Posts : 286
    • Scores: 59
    • Reward points: 0
    • Joined: 2015/03/19 07:30:23
    • Location: Switzerland
    • Status: offline
    Re: Add ISP to WAN2 (FortiGate 60E) 2020/12/16 23:41:51 (permalink)
    5 (1)
    Yes, this is correct...
    #5
    Markus
    Expert Member
    • Total Posts : 286
    • Scores: 59
    • Reward points: 0
    • Joined: 2015/03/19 07:30:23
    • Location: Switzerland
    • Status: offline
    Re: Add ISP to WAN2 (FortiGate 60E) 2020/12/16 23:42:48 (permalink)
    5 (1)
    no, you just use your "internal" as already setup (just named it iternal, maybe you have another naming)
    #6
    Markus
    Expert Member
    • Total Posts : 286
    • Scores: 59
    • Reward points: 0
    • Joined: 2015/03/19 07:30:23
    • Location: Switzerland
    • Status: offline
    Re: Add ISP to WAN2 (FortiGate 60E) 2020/12/16 23:43:47 (permalink)
    5 (1)
    no, you just use your "internal" as already setup (just named it iternal, maybe you have another naming)
    #7
    mdnoor
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/12/16 00:18:49
    • Status: offline
    Re: Add ISP to WAN2 (FortiGate 60E) 2020/12/18 20:26:43 (permalink)
    0
    hi markus thanks for explanation last time i have sucefully point wan2 isp to fortigate 60e, but it still using wan1 as main internet unless wan1 down it will switch to wan2.
     
    so here wan2 is backup unless i create wan load-balancing as you said before only then it will use both isp.


    so next step is to create wan laod-balancing as i have to delete the routing and ipv4 policy then create new.
     
    thanks again
    regards 
    noor
     
     
    #8
    Markus
    Expert Member
    • Total Posts : 286
    • Scores: 59
    • Reward points: 0
    • Joined: 2015/03/19 07:30:23
    • Location: Switzerland
    • Status: offline
    Re: Add ISP to WAN2 (FortiGate 60E) 2020/12/20 02:47:07 (permalink)
    5 (1)
    Hi Noor

    Yes, if you want to loadbalance over 2 ISPs, this is the "simpelst" way to do.

    Best,
    Markus
    #9
    mdnoor
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/12/16 00:18:49
    • Status: offline
    Re: Add ISP to WAN2 (FortiGate 60E) 2020/12/21 21:20:14 (permalink)
    0
    hi markus.
     
    my problem is resolve now the internet has been sharing for both ISP.
     
    for the rest lan port what the use ya?
     
    can i setup the lan port as gateway?
    #10
    sw2090
    Expert Member
    • Total Posts : 848
    • Scores: 60
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Location: Regensburg
    • Status: offline
    Re: Add ISP to WAN2 (FortiGate 60E) 2020/12/22 01:09:14 (permalink)
    0
    there is bascially two ways to achieve that:
     
    1. Two seperate WANs (WAN1 and WAN2) with sperate ISPs. In this case you have to create two default routes. If yu want WAN2 to be fallback in this constellation make sure that the default route for WAN2 has the higher priority/distance than the WAN1 one.
    If there is more than one route for a target (in this case the internet) routes are matched by priority and then distance. So traffic would primarily use the WAN with loweset routing prio and then if that don't work use the other one. This has the disadvantage that there will be no real loadbalancing - just failover.
    Also you need to have every internet policy twice (one for every WAN).
     
    2. Use SD-WAN instead. In this case you need only one default route that uses sd-wan as interface. All Internet policies must use sd-wan as interface for traffic from/to the internet.
    SD-WAN implements several loadbalancing algorithms and also allows you to set own rules for balancing.
    Once you also set up some SD-WAN health check(s) the sd-wan also cares for failover. When the health check(s) detect a WAN being unavailable it will automatically be dropped from sd-wan and is no longer used. Once health check reports the WAN being ok again it will automatically turn back into action and will be used again.
    So you need less policy and routes. Also you don't need to change anything in tohe routing when a WAN goes down. SD-WAN does that automatically.
    Disadvantage: (the only one I yet found for me) Using SD-WAN prevents you from having additional default routes. So if you want to have some WAN outside SD-WAN as fallback - that' snot possible with sd-wan.
    (We would like to use cellular uplink as extra fallback but it would need to be outside sd-wan because using it is expensive and you cannot prevent sd-wan from using it once it is in there.)
     
    #11
    SecurityPlus
    Gold Member
    • Total Posts : 395
    • Scores: 4
    • Reward points: 0
    • Joined: 2014/08/11 18:41:34
    • Status: offline
    Re: Add ISP to WAN2 (FortiGate 60E) 2020/12/22 21:00:10 (permalink)
    0
    Concerning #2 from sw2090, does FortiOS 6.4 add some additional options concerning SD-WAN management options?

    FWF30E, FG40F, FG50E, FWF50E, FG60D, FWF60D, FG60E, FG60F, FG80E, FG100D
    FortiOS 5.2, 5.4, 5.6, 6.0, 6.2, and 6.4
    FortiSwitch FS-224E-POE, FS-124E-POE
    FAP-221E, FAP-224E, FAP-221C
    #12
    Jump to:
    © 2021 APG vNext Commercial Version 5.5