1

Requirement is to divide the WAN zone traffic Two different LAN IP group's internet traffic should go though 2 different WAN connections in fortigate 60D (Currently its WAN Zone(wan1 and wan2) . How to do that configuration?

1

Just providing 2 egress policies won't suffice.

Traffic to unknown target networks has to follow the default route. But, there is only 1 default route per system/FGT (for obvious reasons). To match a (static) route the FGT only looks at the destination IP address.

In your case, this is not enough because you want traffic from different sources to follow different routes through different interfaces. For this, use a Policy Route. To match a PR, you can specify the source subnet address as well as the destination (which is '0.0.0.0/0' for the default route).

So the steps to take are:
1- pull WAN2 from the WAN zone to make it addressable. WAN1 remains in the zone, no changes required.
2- create a Policy route as mentioned, through WAN2
3- create an additional egress policy for 'lan' to 'WAN2'. Don't forget to enable NAT!

  • Pulled out Wan2 , and created a new Wan Zone 2 with WAN2 interface. Created LAN Zone 2 with one dedicated interface, Made the policy to enable traffic from Lan Zone 2 to Wan Zone 2 & Enabled NAT. Routing is there Destination 0.0.0.0/0 Device Wan2 and gateway-ISP gateway. But the internet connectivity is not there. Can you help me in this? – DintoJames Oct 26 '18 at 7:17
  • Please read my post - you need a policy route (Routing > Policy Route) for this. – user1016274 Oct 26 '18 at 10:58
1

The easiest way is to split traffic by firewall policy - just the one WAN interface for one set of policies and the other interface for another set.

If you want to split traffic to different external IP addresses on the same interface you can define an IP Pool (with possibly just a single address) and use that in a policy instead of Use Outgoing Interface Address.

  • Pulled out Wan2 , and created a new Wan Zone 2 with WAN2 interface. Created LAN Zone 2 with one dedicated interface, Made the policy to enable traffic from Lan Zone 2 to Wan Zone 2 & Enabled NAT. Routing is there Destination 0.0.0.0/0 Device Wan2 and gateway-ISP gateway. But the internet connectivity is not there. Can you help me in this? – DintoJames Oct 26 '18 at 7:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.