RSS

Monthly Archives: October 2020

VDOM with load-balancing FortiGate 100D

2 WAN connection combines to provide internet for a VDOM in fortigate. How to configure this is explained below.

Created VDOM for Wifi

Global > System > VDOM > Create New
Virtual Domain: Wifi
Inspection Mode: Proxy

OK

Assigned ports to VDOM wifi

Before moving ports to vdom, Make sure there are no reference to those ports from policies, routes, etc. Also make sure the ports have no IP assigned.

Global > Network > Interfaces >
Select and interface and Edit> change virtual domain of the interface.

In our case there is two WAN ports and and a LAN port for our Wifi topology.
(Port9 = LAN, Port 11 & Port 12 = WAN )

Now we need to create load balancing to combine the speed of both WAN connections. We can do this through FortiGate SD-WAN option.

Go to VDOM Wifi > Networ > SD-WAN > Enable SD-WAN
Click create New.
Seq1: Port 11 – Gateway IP is the IP of the 1st modem.
Seq2: Port 12 – Gateway IP is the IP of the 2nd Modem.

Select load balancing algorithm as “Volume”
Set the volume weight to 1 on both WAN connections.

Apply the changes.

Now create a SD-WAN status check.
It will check wan connection health against an external server.

Goto VDOM Wifi > Network > SD-WAN Status check> Create new
Name: Give a name
Protocol: Ping
Server: 8.8.8.8

Leave other stuff default. Then click ok. This will ocationally ping the google server through
the ports in SD-WAN to check the health of the connection.

Goto VDOM Wifi > Network > Static Routes
Destination: 0.0.0.0/0.0.0.0
Device: sd-wan
Admin distance:10
status: enabled

then press OK.

Assign a policy to allow traffic.
Goto VDOM Wifi > Policy and Objects> IPv4 policy > Create New
Name: Wireless devices
Incoming int: LAN port of the VDOM (port 9)
OutGoing int: SD-WAN
Select appropriate for Source, Destination, Schedule,Service, and Action.
Nat: on
Apply security profiles.
Log allowed traffic: log all sessions.

Now when we assign a new device to this policy the user will be able to access internet through the SD-WAN interface.

 
Leave a comment

Posted by on October 15, 2020 in Uncategorized