Skip to main content
wseaton
wseaton
New Member
November 20, 2017
Question

Basic Static Route help

  • November 20, 2017
  • 2 replies
  • 2953 views

Greetings,

I'm rusty on my Firewall routing having spent most of my time on application issues recently, so forgive my novice questions as I knock the rust off.

I'm working with a company after they fired their MSP and trying to 'finagle' their 100D project back into shape. Basically they want to use their Cable connection as primary and T-1 as failover (we all know the reliability of cable providers and imaginary SLAs). The cable connection was easy to set up on WAN1 and get into production, but the T-1 is giving me a hard time because it doesn't have DHCP on the WAN side and the gateway as I understand it requires a static route. That's where I'm foggy.

Failover set-up appears fairly well documented, so I'll deal with that next, but right now I just want to get my test interface (internal 2) working through the T-1 (WAN2). I'll then deal with setting up failover to our production network (Internal 1). Babysteps....

The T-1 provider gave me two IPs; one to set the external interface of the Forti I presume and the other is their gateway. I've plugged these IP's into my laptop and confirmed the T-1 gives me access to the internet . However, I'm not sure how to get Internal 2 > WAN2 to use this gateway...or the proper format of a Static route to use it. 

    2 replies

    makco10
    makco10
    Explorer II
    November 20, 2017

    Hello,

     

    Look this link: http://cookbook.fortinet.com/installing-a-fortigate-in-natroute-mode-56/

     

    Also you may find more helpful resources in that site.

     

    Regards.

    btp
    btp
    New Member
    November 20, 2017

    You would need two static default routes, one for primary access and one for secondary. Now, if you have DHCP enabled on cable interface, you will get default gateway from this provider. Usually you then get a distance of 5, which is lower than the default static route distance in the Fortigate.

     

    To be able to use both links at the same time the distances must match. In this example both routes are useable:

     

    no0511-fg (root) # get router info routing-table details 0.0.0.0 Routing entry for 0.0.0.0/0   Known via "static", distance 10, metric 0, best   * 172.16.100.1, via mgmt-link1   * 10.20.40.1, via LAB

     

    In this setup wan1 has DHCP enabled (see the distance):

     

    no0301-fg1 (VPN) # get router info routing-table details 0.0.0.0

    Routing entry for 0.0.0.0/0

      Known via "static", distance 5, metric 0, best   * directly connected, IPSEC   * 192.62.174.125, via wan1

     

    Also, see this quite nice article: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD32103&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=120338248&stateId=0%200%20120336319 

    Terms & ConditionsAccessibility statement