Skip to main content
AlexFerenX
New Member
May 7, 2025
Question

Interdependence b/w Link Monitor and interface's "fail-detect"

  • May 7, 2025
  • 1 reply
  • 1344 views

Hi!

consider:

 

config system link-monitor
edit monitor_id

srcintf ifname

server monitored_server

:

update-cascade-interface disable

update-policy-route disable

update-static-route disable

end

 

as I understand, this will cause interface ifname to be marked as failed if monitoring of monitored_server fails. This means all configured dependencies, including all static and dynamic routes, would become unavailable. Please correct me if wrong.

 

I do not understand if the following is necessary and what effect/value it adds to above:

 

config system interface

edit ifname

:

fail-detect enable
fail-detect-option link-down detectserver

end

 

Any one can answer?

Thanks!

1 reply

Toshi_Esumi
SuperUser
SuperUser
May 7, 2025

You meant like this, right?
FortiGate-60F (vogus_server_monitor) # show
config system link-monitor
  edit "vogus_server_monitor"
    set srcintf "wan1"
    set server "100.64.0.1"
    set update-cascade-interface disable
    set update-static-route disable
    set update-policy-route disable
  next
end

The destination doesn't exist in my network and not pingable.

FortiGate-60F # exe ping 100.64.0.1
PING 100.64.0.1 (100.64.0.1): 56 data bytes

--- 100.64.0.1 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

As the result, the link-monitor status is "dead".

FortiGate-60F # diag sys link-monitor status

Link Monitor: vogus_server_monitor, Status: dead, Server num(1), cfg_version=0 HA state: local(dead), shared(dead)
Flags=0x1 init, Create time: Wed May 7 16:20:09 2025
Source interface: wan1 (5)
VRF: 0
Interval: 500 ms
Service-detect: disable
Diffservcode: 000000
Class-ID: 0
Transport-Group: 0
Class-ID: 0
  Peer: 100.64.0.1(100.64.0.1)
    Source IP(75.145.19.83)
    Route: 75.145.19.83->100.64.0.1/32, gwy(75.145.19.86)
    protocol: ping, state: dead
        Packet lost: 100.000%
        MOS: 4.350
        Number of out-of-sequence packets: 0
        Recovery times(0/5) Fail Times(2/5)
        Packet sent: 103, received: 0, Sequence(sent/rcvd/exp): 104/0/0

However, all routes are still there and I didn't lose anything including IPsec vpn over wan1("la-tos1" below).

FortiGate-60F # get router info routing-t all
---[snip]---

Routing table for VRF=0
S* 0.0.0.0/0 [10/0] via x.x.x.x, wan1, [1/0]
                   [10/0] via x.x.x.x, wan2, [10/0]
B 1.2.1.2/32 [20/0] via 10.242.0.1 (recursive via la-tos1 tunnel x.x.x.x), 08:49:47, [ 1/0]
B 10.10.110.1/32 [20/0] via 10.242.0.1 (recursive via la-tos1 tunnel x.x.x.x), 08:49:4 7, [1/0]
B 10.100.100.1/32 [20/0] via 10.242.0.1 (recursive via la-tos1 tunnel x.x.x.x), 08:49: 47, [1/0]

.......

The bottom line is the link-monitor doesn't disable interfaces.
And, the "fail-detection" on an interface is, I believe, only for aggregate interface or redundant interface. Nothing to do with link-monitor.
https://docs.fortinet.com/document/fortigate/7.4.7/administration-guide/321562/failure-detection-for-aggregate-and-redundant-interfaces
https://docs.fortinet.com/document/fortigate/7.4.7/administration-guide/567758/aggregation-and-redundancy


Toshi



AlexFerenX
New Member
May 8, 2025

Hi Toshi!

 

> The bottom line is the link-monitor doesn't disable interfaces.

 

Thank you. So, "system link-monitor" only defines the monitoring test, and affects

1. static route matching system link-monitor's "srcintf" interface if system link-monitor's "update-static-route" is 'enable'; or,

2. PBR matching system link-monitor's "srcintf" interface if system link-monitor's "update-policy-route" is 'enable'; or,

3a. interface matching system link-monitor's "srcintf" interface if that interface's "fail-detect" set to 'enable' AND "fail-detect-option" is set to 'detectserver; and,

3b. as 3a, but also interface specified by "fail-alert-interfaces" if system link-monitor's "update-cascade-interface" is 'enable'

?


> And, the "fail-detection" on an interface is, I believe, only for aggregate interface or redundant interface. Nothing to do with link-monitor

 

See Bring other interfaces down when link mon... - Fortinet Community - in this a slightly different case - there's cascaded interface, port3 (specified by ill-named "fail-alert-interfaces"), but if we do not provision "update-cascade-interface enable" then won't only wan1 will be marked as down?

 

 

config system link-monitor
edit monitor_id

srcintf wan1

server 1.1.1.1

:

update-cascade-interface disable

update-policy-route disable

update-static-route disable

end

 


config system interface
edit wan1
set fail-detect enable
set fail-detect-option detectserver link-down
end


Thanks!

Toshi_Esumi
SuperUser
SuperUser
May 8, 2025

I didn't know about existence of the KB you referred to. This means my understanding was not correct and I need to test the conbination of these features again. Meanwhile wait for somebody else who know about these to chime in.

Toshi