58 Fortinet Inc.
Configuration example: Multiple connections to the Internet NAT/Route mode installation
Firewall policy example
Firewall policies control how traffic flows through the FortiGate unit. Once routing for
multiple internet connections has been configured you must create firewall policies to
control which traffic is allowed through the FortiGate unit and the interfaces through
which this traffic can connect.
For traffic originating on the Internal network to be able to connect to the Internet
through both Internet connections, you must add redundant policies from the internal
interface to each interface that connects to the Internet. Once these policies have
been added, the routing configuration controls which internet connection is actually
used.
Adding a redundant default policy
Figure 8 on page 53 shows a FortiGate unit connected to the Internet using its port2
and port3 interfaces. The default policy allows all traffic from the port1 network to
connect to the Internet through the port2 interface. If you add a similar policy to the
port1 to port3 policy list, this policy will allow all traffic from the port1 network to
connect to the Internet through the port3 interface. With both of these policies added
to the firewall configuration, the routing configuration will determine which Internet
connection the traffic from the internal network actually uses. For more information
about the default policy, see “Default firewall configuration” on page 170.
To add a redundant default policy
1Go to Firewall > Address > port3.
2Add the following address to port3.
3Go to Firewall > Policy > port1->port3.
4Select New.
5Configure the policy to match the default policy.
6Select OK to save your changes.
Address Name Port3_All
IP Address 0.0.0.0
Netmask 0.0.0.0
Source Port1_All
Destination Port3_All
Schedule Always
Service ANY
Action Accept
NAT Select NAT.