Configuring Fortigates to use new MPLS connection instead of VPN over WAN connections

Posted on 2013-01-25
Last Modified: 2013-03-19

I am trying to figure out how to configure my FortiGate units at my Main Office location and my branch office location to use a new MPLS connection and remove the VPN connection that was setup using the WAN connections in both locations.  I would like to move the traffic between the locations across the new MPLS connection, and all other traffic (internet, email, etc) out the WAN1 internet ports.  It is a managed MPLS connection setup with an IP Address inside the LAN subnets on each end.  Currently I have a server on each end set up with a static IP inside the subnet on each end with the gateway on each server pointing to the IP Address on the managed routers for the MPLS for each end and I can ping across from both directions successfully so I know the line is working correctly.

My main office location has a Fortigate 110C that has two WAN ports and eight internal ports.
My main internet connection is plugged into the WAN1 port and my current VPN created in the FortiGate unit is setup using this port to make a connection to the remote site.

My branch office location has a FortiGate 60C that has two WAN ports and five internal ports.
My main internet connection is plugged into the WAN1 port and my VPN is using this connection to connect to the main office.

My question is can I use the WAN2 ports on each end to use the MPLS line or will I need to plug them into an internal port and create static routes to move the traffic between locations?
I am not sure how to address this issue since the IP Addresses on the managed routers for the MPLS are inside my LAN subnets.

Main Office  FortiGate 110C
Lan             10.1.0.x/24

Branch Office  FortiGate 60C
Lan             10.100.0.x/24

I will appreciate any and all help that comes my way.
Question by:OklahomaSteel
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 18

Accepted Solution

Garry Glendown earned 500 total points
ID: 38821696
If you already have a gateway in your LAN, you shouldn't need to use the WAN2 port, just set up a static route towards the gateway router ... set up the appropriate policies to let the traffic through and you should be done ...

Author Comment

ID: 38825082
It appears to be working correctly. Thank you.

Featured Post

Retailers - Is your network secure?

With the prevalence of social media & networking tools, for retailers, reputation is critical. Have you considered the impact your network security could have in your customer's experience? Learn more in our Retail Security Resource Kit Today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
This is an article about my experiences with remote access to my clients (so that I may serve them) and eventually to my home office system via Radmin Remote Control. I have been using remote access for over 10 years and have been improving my metho…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question