Skip to main content
Reshans
Visitor III
June 12, 2025
Question

How to automatic disable static route in ipsec tunnel when tunnel goes down

  • June 12, 2025
  • 5 replies
  • 2811 views

In our FortiGate environment, both BGP and static routes are configured for the same destination. However, the system currently prefers the static route, which remains active at all times. As a result, during an IPsec tunnel failure, traffic does not automatically fail over to the BGP route. At present, we are required to manually disable the static route on both ends to allow BGP to take over. We are seeking a solution that enables automatic failover from the static route to the BGP route when the IPsec tunnel goes down.

 

Ipsec tunnel not showing in interfaces

 

 

5 replies

funkylicious
SuperUser
SuperUser
June 12, 2025

why not just delete the static route, which will take precedence always?

other options would be to either do a automation stitch to delete/disable the static route when a event for the ipsec is down or https://community.fortinet.com/t5/FortiGate/Technical-Tip-Link-Monitor-Explained/ta-p/197504 

"jack of all trades, master of none"
Toshi_Esumi
SuperUser
SuperUser
June 12, 2025

With FGTs, even if you put the same admin distance on the static route with BGP, like 20 for eBGP/200 for iBGP, it doesn't place both routes as parallel routes in the routing table. Instead, the newly introduced route wins.

You didn't explain the whole topology including both paths. But eventually the best option is to set up BGP through the primary IPsec path as well so that you can set local-preference to prefer primary IPsec path at the BGP level.

Otherwise you have to use link-monitor as @funkylicious suggests. It's quite ugly to have both static routing path and BGP routing path for the same destination when the static side is the primary. 

Toshi 

Reshans
ReshansAuthor
Visitor III
June 12, 2025

Veerakesari SDWAN HLD.jpg

 

This is my topology and so Tunnel 3 for used sttaic route tunnel 3 separate tunnel in for NAS server access i need when tunnel 3 goes down need to automatic disable this sttaic routes

Toshi_Esumi
SuperUser
SuperUser
June 12, 2025

It doesn't show the topology of the BGP domain. Which ones are BGP neighbors?

 

Toshi 

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!