Configuration example: Multiple connections to the Internet | NAT/Route mode installation |
|
|
Firewall policy example
Firewall policies control how traffic flows through the FortiGate unit. Once routing for multiple internet connections has been configured you must create firewall policies to control which traffic is allowed through the FortiGate unit and the interfaces through which this traffic can connect.
For traffic originating on the Internal network to be able to connect to the Internet through both Internet connections, you must add redundant policies from the internal interface to each interface that connects to the Internet. Once these policies have been added, the routing configuration controls which internet connection is actually used.
Adding a redundant default policy
Figure 8 on page 53 shows a FortiGate unit connected to the Internet using its port2 and port3 interfaces. The default policy allows all traffic from the port1 network to connect to the Internet through the port2 interface. If you add a similar policy to the port1 to port3 policy list, this policy will allow all traffic from the port1 network to connect to the Internet through the port3 interface. With both of these policies added to the firewall configuration, the routing configuration will determine which Internet connection the traffic from the internal network actually uses. For more information about the default policy, see “Default firewall configuration” on page 170.
To add a redundant default policy
1Go to Firewall > Address > port3.
2Add the following address to port3.
Address Name | Port3_All |
IP Address | 0.0.0.0 |
Netmask | 0.0.0.0 |
3Go to Firewall > Policy > port1->port3.
4Select New.
5Configure the policy to match the default policy.
Source Port1_All
Destination Port3_All
Schedule Always
Service | ANY |
Action | Accept |
NAT | Select NAT. |
6Select OK to save your changes.
58 | Fortinet Inc. |
