Home / Basic IT / Digital Insights / firewall

Dual ISP Redundant Configuration Guide Using Firewall Fortigate / Sophos

Oleh Author Post a Comment

Panduan Konfigurasi Dual ISP Redundant Menggunakan Firewall Fortigate / Sophos (English Version)

The coffee in my mug had gone cold for the third time tonight. Outside, the city slept—or pretended to. Somewhere in the digital ether, a thousand Zoom calls were buffering, a hundred gamers were raging about lag, and one very tired sysadmin was probably contemplating career choices that didn't involve routers. It was 2:17 AM, and I was thinking about redundancy. Not the boring, technical kind you find in manuals, but the human kind. The backup plans we make for relationships, the emergency exits we keep in our minds, the spare keys we hide under flower pots. We build fallbacks for our hearts, but when it comes to our internet connections? We cross our fingers and pray to the broadband gods.

Last week, my neighbor—a yoga instructor who now teaches via streaming—told me her internet died mid-downward-dog. "The screen just froze," she said, "and thirty people were staring at my... well, you know." She lost three clients that day. The ISP said it was "scheduled maintenance." They never seem to schedule these things with our downward dogs in mind, do they?

The Philosophy of Having a Plan B

There's something profoundly human about wanting a safety net. We have spare tires in our cars, emergency cash in our drawers, and extra batteries for the remote. Yet our digital lives—the ones that now include livelihoods, education, and human connection—often hang by a single thread of fiber optic cable. One cut, one outage, one "technical difficulty" and poof. The modern world grinds to a halt.

Dual ISP redundancy isn't just about technology. It's about acknowledging that things break. That systems fail. That sometimes, the universe decides today is the day your main internet connection takes a nap. It's digital humility—the understanding that we're not in complete control, but we can at least prepare for the chaos.

Understanding the Basic Concepts

Before we dive into configuration, let's talk about what we're actually building here. You're creating what I like to call a "digital marriage counselor"—a system that manages the relationship between two internet connections, making sure they play nice together.

Load Balancing: This is like having two checkout lines at the grocery store. The traffic gets distributed between both ISPs based on algorithms—maybe by volume, maybe by sessions, maybe by source IP. Everyone gets through faster, but if one line closes, the other handles everything.

Failover: The classic Plan B. Your primary connection does all the work until it can't. Then, like a reliable understudy, the backup connection takes the stage seamlessly. No dropped calls, no frozen yoga streams.

Policy Routing: This is where things get smart. You can tell certain types of traffic which path to take. Maybe video calls always use ISP A because it has lower latency, while large downloads go through ISP B because it has higher bandwidth. It's like having a traffic cop who knows every driver's destination.

Fortigate Configuration: Step by Step

Let's get our hands dirty. I'll assume you have basic FortiGate knowledge and two WAN interfaces ready (we'll call them wan1 and wan2).

Step 1: Configure Your WAN Interfaces
First, make sure both internet connections work independently. Test them. Know their IPs, gateways, and which one is faster or more reliable. This matters more than you think—you don't want your backup to be worse than no backup at all.

Step 2: SD-WAN Configuration
FortiGate makes this relatively painless with SD-WAN. Create an SD-WAN zone and add both WAN interfaces as members. The magic happens in the SD-WAN rules and performance SLAs.

Create a performance SLA to monitor your primary gateway. Set it to ping a reliable server (like 8.8.8.8) every 500ms. If it fails three times in a row, that's your cue to fail over.

Step 3: Load Balancing Algorithm
Choose how you want to distribute traffic. Volume-based? Session-based? Source-destination IP? For most small offices, session-based works well—it prevents a single download from hogging all the bandwidth.

Step 4: Policy Routing Rules
This is where you get creative. Create policies that match your business needs. Maybe all VoIP traffic (SIP, RTP) should prioritize the low-latency connection. Maybe backup traffic to the cloud should use the cheaper connection. Think about what matters most to your specific situation.

Step 5: Testing, Testing, Testing
Don't wait for an actual outage to discover your configuration doesn't work. Simulate failures. Unplug the primary connection. Watch the logs. See how long it takes to fail over. Time it. Know your recovery time objective because your yoga instructor clients certainly will.

Sophos XG Configuration: A Different Approach

Sophos does things a bit differently, but the philosophy remains the same. You're still building that safety net, just with different tools.

Step 1: Configure Link Redundancy
In Sophos, you'll work with Link Redundancy Groups. Create a group, add both WAN connections, and set your failover conditions. The monitoring is similar—ping critical hosts and fail over when they become unreachable.

Step 2: Outbound Load Balancing
Sophos calls this "Outbound Load Balance" policies. You can define ratios for how traffic splits between connections. 70-30? 50-50? It depends on your bandwidth and reliability for each ISP.

Step 3: Business Application-Based Routing
Sophos excels here with its application awareness. You can create policies that route specific applications (Zoom, Teams, Netflix) through specific connections. It's like having a bouncer who knows exactly which door each guest should use.

Step 4: Don't Forget the Firewall Rules
Both FortiGate and Sophos require proper firewall rules to allow the traffic you've so carefully routed. It's like building a beautiful highway and forgetting to open the toll gates.

The Human Element of Redundancy

As I finally finish this coffee—now officially undrinkable—I'm struck by how much our technical solutions reflect our human needs. We build redundant systems not because we're paranoid, but because we're practical. Because we know that things break, that people depend on us, and that sometimes, the most important thing we can do is have a backup plan.

Your dual ISP setup isn't just about uptime percentages and bandwidth metrics. It's about the yoga instructor who keeps her clients. The student who doesn't miss an online exam. The small business that stays connected to its customers. It's about building something resilient in a world that's increasingly fragile.

So configure those firewalls. Test those failovers. And maybe, while you're at it, think about the other safety nets in your life—the ones that have nothing to do with technology, and everything to do with being human.

FAQ: Dual ISP Redundancy

Q: Do I really need two ISPs? My connection seems reliable enough.
A: Ever had a power outage? Car trouble? Internet is infrastructure, not magic. If your business or work depends on it, one is none, two is one.

Q: What's better—load balancing or failover?
A: Why choose? Modern firewalls let you do both. Use load balancing for efficiency, failover for reliability. It's like having both seatbelts and airbags.

Q: How much downtime should I expect during failover?
A: With proper configuration, 3-10 seconds. Enough for a deep breath, not enough to ruin a video call. Test it and know your numbers.

Q: Can I use different types of connections? (Fiber + 5G, for example)
A: Absolutely! Diversity is your friend. Different technologies fail in different ways. Fiber might get cut, but cellular might survive. It's the digital version of not putting all your eggs in one basket.

Q: Will this double my internet speed?
A: Not for single downloads or streams. Think of it as having two lanes instead of one—more cars can travel, but each car still has a speed limit.

Q: Is this configuration too complicated for a small business?
A: The concepts might feel overwhelming at first, but the actual configuration has become much simpler in modern firewalls. The complexity is front-loaded—spend time planning, and the implementation becomes straightforward.

Q: What's the most common mistake people make?
A: Not testing the failover. They set it up, assume it works, and discover the hard way during an actual outage that something was misconfigured. Test like your business depends on it—because it does.

Enjoying this story?

Before you go, discover a modern way to build fast and secure administrative applications — meet CoreDash™.

🚀 The Foundation for Fast & Secure Web Administration

CoreDash™ is a lightweight yet powerful administrative template built with pure PHP + Bootstrap SB Admin 2, designed to help developers and organizations build secure, structured, and scalable management systems — without heavy frameworks.

✨ Key Highlights

🧩 Modular ArchitectureFeature-based modules (Users, Roles, Settings etc.).
🔐 Secure Login SystemBcrypt encryption, RBAC, and OWASP validation.
📊 DataTables & Select2Smart tables with search, sort, and interactive dropdowns.
⚙️ Multi-Database SupportNative compatibility with PostgreSQL and SQL Server.
🎨 Dynamic BrandingChange logos, colors, and names from the panel.

With CoreDash™, you don't just get a template — you get a secure, scalable foundation to build professional-grade administrative systems that perform fast and look elegant.

🛒 Buy CoreDash™ Now

🚀 Try CoreDash™ Demo

Demo Login Credentials:
Username: admin
Password: 123456

*Use the credentials above to explore the full administrative features.

Author is a multi-talented Indonesian artist, writer, and content creator. Born in December 1987, she grew up in a village in Bogor Regency, where she developed a deep appreciation for the arts. Her unconventional journey includes working as a professional parking attendant before pursuing higher education. Fajar holds a Bachelor's degree in Computer Science from Nusamandiri University, demonstrating her ability to excel in both creative and technical fields. She is currently working as an IT professional at a private hospital in Jakarta while actively sharing her thoughts, artwork, and experiences on various social media platforms.

Thank you for stopping by! If you enjoy the content and would like to show your support, how about treating me to a cup of coffee? �� It’s a small gesture that helps keep me motivated to continue creating awesome content. No pressure, but your coffee would definitely make my day a little brighter. ☕️ Buy Me Coffee

Post a Comment for "Dual ISP Redundant Configuration Guide Using Firewall Fortigate / Sophos"

Post a Comment

You are welcome to share your ideas with us in comments!