Dual Internet connections

Dual internet connections, also referred to as dual WAN or redundant Internet connections, refers to using two FortiGate interfaces to connect to the Internet. Dual Internet connections can be used in three ways:

• Redundant interfaces: if one interface goes down, the second interface automatically becomes the main Internet connection
• Load sharing: to ensure better throughput
• Combination of redundancy and load sharing

Redundant interfaces

Redundant interfaces ensure that if your Internet access is no longer available through a certain port, the FortiGate unit will use an alternate port to connect to the Internet.

Configuring redundant interfaces

In this scenario, two interfaces, WAN1 and WAN2, are connected to the Internet using two different ISPs. WAN1 is the primary connection. In the event of a failure of WAN1, WAN2 automatically becomes the connection to the Internet. For this configuration to function correctly, you need to configure three settings:

• Configure a link health monitor to determine when the primary interface (WAN1) is down and when the connection returns
• Configure a default route for each interface
• Configure security policies to allow traffic through each interface to the internal network

Link health monitor

Adding a link health monitor is required for routing failover traffic. A link health monitor will confirm the connectivity of the device’s interface.

To add a link health monitor

config system link-monitor

edit “Example1”

set srcint <Interface_sending_probe>

set server <ISP_IP_address>

set protocol <Ping or http>

set gateway-ip <the_gateway_IP_to_reach_the_server_if_required>

set failtime <failure_count>

set interval <seconds>

set update-cascade-interface enable

set update-static-route enable

set status enable

end

Routing

You need to configure a default route for each interface and indicate which route is preferred by specifying the distance. The lower distance is declared active and placed higher in the routing table.

When you have dual WAN interfaces that are configured to provide failover, you might not be able to connect to the backup WAN interface because the FortiGate unit may not route traffic (even responses) out of the backup interface. The FortiGate unit performs a reverse path lookup to prevent spoofed traffic. If an entry cannot be found in the routing table that sends the return traffic out the same interface, the incoming traffic is dropped.

To configure the routing of the two interfaces - web-based manager

1. Go to Network > Static Routes and select Create New.
2. Enter the following information and select OK.

Destination IP/Mask	For an IPv4 route, enter a subnet of 0.0.0.0/0.0.0.0 For an IPv6 route, enter a subnet of ::/0
Gateway	Enter the gateway address
Interface	Select the primary connection. For example, WAN1.
Administrative Distance	Leave as the default of 10.

3. Repeat these steps to set Interface to WAN2 and Administrative Distance to 20.

To configure the IPv4 routing of the two interfaces - CLI

config router static

edit 0

set dst 0.0.0.0 0.0.0.0

set device WAN1

set gateway <gateway_address>

set distance 10

next

edit 0

set dst 0.0.0.0 0.0.0.0

set device WAN2

set gateway <gateway_address>

set distance 20

next

end

To configure the IPv6 routing of the two interfaces - CLI

config router static6

edit 0

set dst ::/0

set device WAN1

set gateway <gateway_address>

set distance 10

next

edit 0

set dst ::/0

set device WAN2

set gateway <gateway_address>

set distance 20

next

end

Security policies

When creating security policies, you need to configure duplicate policies to ensure that after traffic fails over WAN1, regular traffic will be allowed to pass through WAN2 as it did with WAN1. This ensures that failover will occur with minimal effect to users. For more information about creating security policies, see the Firewall Guide.

Load sharing

Load sharing allows you to use both connections to the Internet at the same time, but does not provide failover support. When configuring load sharing, you need to make sure that routing is configured for both external ports (for example, WAN1 and WAN2) have static routes with the same distance and priority.

For more information about load sharing, see the Advanced Routing Guide.

Link redundancy and load sharing

In this scenario, both links are available to distribute Internet traffic over both links. Should one of the interfaces fail, the FortiGate unit will continue to send traffic over the other active interface. Configuration is similar to the Redundant interfaces configuration, with the main difference being that the configured routes should have equal distance settings.

This means both routes will remain active in the routing table. To make one interface the preferred interface, use a default policy route to indicate the interface that is preferred for accessing the Internet. If traffic matches the security policy, the policy overrides all entries in the routing table, including connected routes. You may need to add specific policy routes that override these default policy routes.

To redirect traffic over the secondary interface, create policy routes to direct some traffic onto it rather than the primary interface. When adding the policy route, only define the outgoing interface and leave the gateway blank. This ensures that the policy route will not be active when the link is down.

SSL VPN and WAN link load balancing

You can set virtual WAN link interfaces as destination interfaces in firewall policies for WAN link load balancing, when SSL VPN is the source interface. For example, you can log in to FortiGate using an SSL VPN for traffic inspection and then have outbound traffic load balanced by WAN link load balancing.

You can set a virtual WAN link interface as a destination interface in a firewall policy where SSL VPN is the source interface, using either the FortiGate GUI (FortiOS 5.6.1 and later) or CLI.

In the CLI, use the following CLI commands:

config firewall policy

edit <policy_id>

set dstintf virtual-wan-link

end