FortiWAN Configurations

Relay Mode

To enable Multihoming in relay mode, go to Service > Multihoming on the Web UI, check the boxes Enable Multihoming and Enable Relay.

When Relay is enabled, FortiWAN will relay the DNS requests it receives to a specified name servers, and reprocess the answer with appropriate IP address according to the AAAA/A record policies. The necessary configurations for Multihoming in Relay Mode are AAAA/A Record Policy and Domain Settings. The name server the Multihoming Relay Mode forward a DNS request to must be configured in field “Domain Settings”. Only if the AAAA/A record of the request answer that the name serve responds to FortiWAN matches Multihoming’s AAAA/A Record, the request answer will be reprocesses with appropriate IP address according to the AAAA/A record policies, otherwise, Multihoming will simply forward the DNS answer to client without any changing. Please make sure the same configuration of AAAA/A record on both FortiWAN Multihoming and the specified name server working with Multihoming Relay Mode.

Note that it’s necessary to update the registrations on your parent domain with FortiWAN’s localhost IP addresses, so that a request for your domain can be delivered to FortiWAN and forwarded to the specified name server.

For other query type such as MX and TXT, Multihoming’s Relay Mode will simply forward the answer from the specified name server to clients.

Policy Settings: A/AAAA Record Policy

Please refer to Policy Settings: A/AAAA Record Policy in Non-relay mode.

Domain Settings

Domain Name
Domain Name The registered domain name that Multihoming relays the queries for, such as example.com.
Name Server
IPv4 Address Specify the IPv4 addresses of the name servers authoritative for the domain and Multihoming relays the queries to.
IPv6 Address Specify the IPv6 addresses of the name servers authoritative for the domain and Multihoming relays the queries to.

A/AAAA Record

Please refer to A/AAAA Record in Non-relay mode.

Scenarios

Example 1

Here is a typical usage to balance inbound traffic load by Multihoming (non-relay mode). Thinking about the inbound traffic to access a virtual server on FortiWAN, Multihoming distributes the accesses over Multiple WAN links by dynamically answering the best WAN link IP to DNS queries for www.domainname.com (domain name of the virtual server). The followings are the related configurations.

An internal web server (192.168.0.100 on HTTP 80) is installed in LAN and virtual server on FortiWAN is associated with it by the following settings on Web UI: Service > Virtual Server (See Virtual Server for details):

WAN IP Service Algorithm Server Pool

Server IP

Service
211.21.33.186 HTTP (80) Round-Robin 192.168.0.100 HTTP(80)
61.64.195.150 HTTP (80) Round-Robin 192.168.0.100 HTTP(80)

This web server is bound to the two WAN ports. Accesses on 211.21.33.186 and 61.64.195.150 for HTTP 80 will be translated to the real server 192.168.0.100 in LAN. To get details about WAN configurations, see Configuring your WAN.

To make accesses distributed among the two WAN links according their upstream load, you need to have Multihoming configured as followings. Go to Service > Multihoming on Web UI, enable Multihoming (disable Relay) and have the following basic settings configured.

A Record Policy Settings

Policy Name Algorithm Policy Advance Setting

WAN Link                 IPv4 Address

web By Upstream 1                                211.21.33.186
2                                61.64.195.150

This entry was posted in Administration Guides, FortiWAN on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.