New Member

Question

Failover between two ISPs

Forum|Forum|10 years ago
August 25, 2015
14 replies
24910 views

Hi Guys,

Apologies if this has been asked before - I'm new to the forum and to Fortinet.

We currently have 2 individual networks connected to separate ISPs and we use a Fortigate 600c firewall in each network.

I need each network to be able to use the other link as a back up route to the internet should it's primary ISP connection fail.

I'd like to know the simplest configuration for this - My initial thought is to set up a second static route with a higher distance between the WAN 2 ports on each firewall? Traffic from each network needs to be isolated but still be able to access the internet when the primary ISP fails.

Any help/advice would be appreciated.

Thanks

Internet failover.jpg

ykonstantakopoulos

New Member

Hi Chris,

As you already suggested set up a second static route with a higher distance between the WAN 2 interfaces on each firewall.

Then make sure you have on both firewalls policies WAN2 -> WAN1. This way you isolate the networks.

And if I'm right (probably you won't need this) make sure you have policy routes in place! all traffic coming from WAN2 interface is routed to WAN1.

thanks,

yiannis

Somashekara_Hanumant

Staff & Editor

Hi,

Please refer the below Video link

http://video.fortinet.com/video/105/redundant-internet-connections-5-2

Hope this helps you to configure dual ISP.

Cheers

vjoshi_FTNT

Staff

Hello,

May I know if both the networks are geographically different and possibility of the physical connections between them?

Also, we need to keep in the mind about what if the interface stays UP, but the internet is down, gateway detect should help in this case.

Chris wrote:
Hi Guys,

Apologies if this has been asked before - I'm new to the forum and to Fortinet.

We currently have 2 individual networks connected to separate ISPs and we use a Fortigate 600c firewall in each network.

I need each network to be able to use the other link as a back up route to the internet should it's primary ISP connection fail.

I'd like to know the simplest configuration for this - My initial thought is to set up a second static route with a higher distance between the WAN 2 ports on each firewall? Traffic from each network needs to be isolated but still be able to access the internet when the primary ISP fails.

Any help/advice would be appreciated.

Thanks

Chris5Author

New Member

Hi,

Thanks for your help guys - the plan is coming together.

Geographically we are in the same location and share a server room (& IT Team)- the firewalls are racked next to each other but are in different networks and connected to different ISPs (essentially we are 2 companies sharing office space - we are under the same umbrella company so sharing the ISPs for fail over is no issue). Each network uses a different IP addressing scheme (192.168.0.0 and 10.0.0.0) so I don't see an issue here.

I've seen you can set up a ping to determine that each link is active - after a few successive failures we want the connection to fail over.

gschmitt

New Member

The easiest way:

Connect the two FortiGates on the wan2 port

Go to System > Network > Interface

Assign FortiGate1 an IP Address on wan2 172.16.0.1/30

Assign FortiGate2 an IP Address on wan2 172.16.0.2/30

Go to Router > Static > Static Routes

On FortiGate1 create a new route

Destination 0.0.0.0/0.0.0.0

Device wan2

Gateway 172.16.0.2

Distance 11 (greater than your default route)

On FortiGate2 do the same but

Gateway 172.16.0.1

Create a new Static route on FortiGate1

Destination 10.0.0.0/8

device wan2

Gateway 172.16.0.2

Distance 10

On FortiGate2 do the same but

Destination 192.168.0.0/16

Gateway 172.16.0.2

Now go to Policy&Objects > Objects > Addresses

On FortiGate1 create an object for Network_fortigate2 with 192.168.0.0/16

On FortiGate2 create an object for network_fortigate1 with 10.0.0.0/8

Go to Policy&Objects > IPv4 > Policies

On FortiGate1 create new Policy

Incoming Interface: wan2

Source Address: network_fortigate2

Outgoing Interface: wan1

Destination Address: all

Enable NAT

configure rest as needed

On FortiGate2 do the same but

Source Address: network_fortigate1

Go to Router > Static > Settings

Create two new Link Health Monitor

Interface wan1/wan2

Gateway on wan2 Fortigate1: 172.16.0.2 / on fortigate2: 172.16.0.1

On wan1 Gateway from your ISPs

Enable health check

Ping

8.8.8.8 (or whatever you like)

The optimal way would be a HA setup with both devices, that way if one internet connection fails the other takes over AND if one of the FortiGates dies the other takes over

ede_pfau

SuperUser

When setting up the Link Health Monitor ALWAYS configure at least 2 independent ping target servers! If Google ever takes down 8.8.8.8 for maintenance both WAN lines will be killed...

And no, I would not choose ANY host on the internet just because it's IP address is easy to remember. Choose a host nearby, for instance one located with your ISP (DNS - might or might not allow pings).

You can set additional target IPs in the CLI (only).

gschmitt

New Member

ede_pfau wrote:
If Google ever takes down 8.8.8.8 for maintenance both WAN lines will be killed...

If Google ever takes down 8.8.8.8, even for a second, half of the worlds monitoring scripts and DNS queries would fail and the world would probably collapse. Or at least a few sysadmins ;)

Choose a host nearby, for instance one located with your ISP (DNS - might or might not allow pings).

Your ISPs gateway probably is the best choice (if you can ping it)

Telekom (as an example) took down a few "old" DNS servers and suddenly a customers internet connection failed ;)

Chris5Author

New Member

Hi Guys,

Thanks for all your help - The Failover is up and running!

I have one further question - Is there an alert or log I can set up so I can tell when the primary link has failed?

Just to be clear the firewalls are configured and pinging externally to check the link state - I've checked that it works by physically taking each cable out and ensuring connectivity from both networks. I'd simply like an email or log I can check to find out when the redundant link has been in use.

Any thoughts?

Thanks

Allwyn_Mascarenhas

New Member

Chris wrote:
Hi Guys,

Thanks for all your help - The Failover is up and running!

I have one further question - Is there an alert or log I can set up so I can tell when the primary link has failed?

Just to be clear the firewalls are configured and pinging externally to check the link state - I've checked that it works by physically taking each cable out and ensuring connectivity from both networks. I'd simply like an email or log I can check to find out when the redundant link has been in use.

Any thoughts?

Thanks

i've been thinking of this, can't think of any automatic feature in fortigate which can do this. I guess a batch file which keeps pinging the primary wan every 30mins or so as a scheduled task and raises a pop-up when the pings fail can do this work.

Do share if you get a way to do this.

ede_pfau

SuperUser

A link failure is logged as a System Event (level "alert"). You could set up the admin email feature to get notified of "alert" or "critical" events.

SNMP trap is your second option, the way the bulk of network devices are monitored or "alerting" their admin.

Pulling the cable is only half smart. Link failure will always be noticed (by observing the link status of the interface) by a FGT cluster. What the (invaluable) ping server feature gives you is detection of connectivity failures further up the stream, beyond the first router or switch.

emnoc

New Member

You have many choices

1: use the 2nd wan port as your earlier thoughts and adjust the distance & use dead gateway detect

2: combine both units to to be a vdom cluster ( this would give you redundancy also btw )

3: place a static route thru the other unit to reach the other ISP ( this would generate more fw-policies to manage probably not ideal )

0x_nuLL_

New Member

two static default routes through your wan interfaces with the minial distance to the primary ISP and higher distance on the another route.

Configure policies LAN->WAN1 and LAN->WAN2 like you desire, or create a zone interface to avoid make a lot of policies.

Greetings.

matt1

New Member

Hi Chris

Think the easiest thing for you to do on this would be to setup an interface on each firewall with a private point to point network /30

Setup routes and policies as need to give i each network access to the others internet connection.

you will also want to setup link heath checks to monitor the the internet links if you want automatic fail over to the back up link

Regards

zlimmen

New Member

how do i do this on 5.4.1 firmware? i can not find the "Router > Static > Settings"

please help, feeling "lost" with all the changes in 5.4 :\

Sign up

Login with SSO

Login to the community

Login with SSO