Skip to main content
RockMan
RockMan
New Member
August 15, 2024
Question

Fortigate Dual WAN Active-Passive

  • August 15, 2024
  • 1 reply
  • 2047 views

Hi all. I am trying to configure a new Fortigate setup, with 2x WANs. I did search before asking you, but I could not figure out how to achieve an Active-Passive scenario. WAN-2 is very unstable, it should be passive and not take any traffic as long as the other WAN-1 is up.

 

A youtube video instructed

  1. Configuring 2 SD-WAN members (WAN-1 and WAN-2) under a virtual WAN link.
  2. Then he created a Performance SLA that sends ping to 8.8.8.8 for All SD-WAN members, enabled Update static route option.
  3. Then he edited the SD-WAN rule, configured load-balancing algorithm by volume (he did it 80% 20%)
  4. Finally he added 0.0.0.0 route using interface virtual WAN link, and added a firewall policy.

This is not what I want, since traffic is distributed. 

I want traffic to flow through WAN-1. When WAN-1 goes down, should be detected, and WAN-2 should take over. But when WAN-1 comes back online, it should take over the traffic again. I am sorry if this has been asked before.

 

Could you please tell me step-by-step how to achieve this? Thanks in advance. Regards

1 reply

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
August 15, 2024

If you want to do this with SD-WAN, you can set the implicit policy (at the bottom of SD-WAN Rules) with algorithm: Sessions or Volume, then set the "weight" of unpreferred wan to "0" while the preferred wan has a possitive number, like 10.
With this setting all traffic which doesn't match any explicit rules above goes out only through the preferred wan. Then only in case the preferred wan goes down, the unpreferred wan would be used.
But you probably want to have a way to test the second circuit. So I would create at least one explicit rule like destination 8.8.4.4/protocol number 1(ICMP) toward the unpreferred wan to override the implicit rule.

On the other hand, if you don't want to use SD-WAN, you can set two static default routes to both circuits (you need to disable dynamic gateway if the circuit is DHCP/PPPoE) but set the "priority number" of the unpreferred default route higher like 10 (default is 0), so that only the preferred circuit would be uses for outgoing traffic as long as it's up.

Toshi

Terms & ConditionsAccessibility statement