Enable interface automatic failover

Forum|Forum|16 years ago
March 18, 2010
2 replies
6408 views

Fortigate60. I am new to the fortigate devices. We have two internet connections using primary ethernet and a backup ADSL. The primary connection failed but the connection did not failover. I check under system-->config-->ha. The firewall is setup as a " standalone" . The heartbeat interface is setup with the dmz, wan1. The primary is setup as wan1 and the backup connection is as wan2. If I enable the checkbox on wan2 as another heartbeat interface will this fix the issue?

A

Anonymous_UserAuthor

Contributor

Hi Mike HA is not the feature you require, this is High Availability between two physical Fortigates. what you are trying to do is very simple (as long as you are running at least V4MR1 which has ECMP (Equal cost Multipath routing) if your not running this it will still work but ECMP will allow you to utilise BOTH LINKS at the same time (when it' s fixed. Simply follow these three steps to get it working 1 Ensure the WAN1 and WAN2 interfaces are configured correctly under system>network 2 Ensure firewall policues are set up correctly under firewall > Policy. you will have to have TWO identical rules allowing traffic on both interfaces. 3 if you wish to use ECMP under router > static select WEIGHTED at the top right. creat TWO default routes and bing them to two interfaces. if you do use ECMP leave distance the same and weighting the same. this will utilise both links equally. if you dont use ECMP set the distance of the primary link to anything lower than the secondary. this will utilise the second link untill the primary is fixed. Cheers Dave

A

Anonymous_UserAuthor

Contributor

The current config has 2 default routes to the different gateways for the different interfaces. The primary is set to 5 and the backup is set to 10. I did not change anything. This should have worked.

A

Anonymous_UserAuthor

Contributor

Mike there are only 3 things required for internet access thats interface setup, routing and firewalling. if your certain the interfaces and routing is setup correctly i would check the firewall. you should have (assuming the LAN is in Switch and the DSL lines are in wan1 and wan2) Switch > Wan1 Switch > wan2 the rules should be identical if you want the same functionality. define the intenal addresses in firewall > address and select these as the sorce destination should be all service should be at least HTTP, HTTPS and DNS as a bare minimum to browse the web action should be accept Nat box should be ticked (assuming it' s a private subnet internally and you have at public IP' s from your ISP defined on the interface in system > Interface) the traffic will appear to be from the interface IP unless you have configured an IP pool and appied it to the policy (ignore this if it' s a simple install) routes should be under router > static then static route tab (assuming you havent configured policy based routing? (this will screw it up if you have configured it incorrectly as policy routes take preccidence over static routes) destination should be 0.0.0.0/0 for both routes Device should be Wan1 for one route and wan2 for the other gateways should be different and should be the IP of the next hop router distance should be different (assuming no ECMP) this is the administrative distance and lower numbers take precidence over high ones. ensure the corralation between next hop IP and device are correct (dont cross them over as this wont work either) are you sure the backup link is working? from a PC connected to the LAN open an SSH/telnet session to the firewall and enter the following to test diag sniffer packet any ' host " YOUR PCS IP ADDRESS" and icmp' 4 press enter from the command prompt of the PC you specified in the diag command ping google. if you can see the traffic entering wan1 and leaving wan2 the fortigate is probably configured correctly and the problem exists on the outside. if you can see the traffic entering switch and leaving on a different interface of not leaving at all the problem is with the fortigate dave