New Member

Question

Need to change WAN1 to WAN2 as primary

Forum|Forum|3 years ago
July 11, 2023
31 replies
19986 views

Hello there,

We have two WANs in place. We just upgraded our Internet for WAN2 today. We are going to be losing WAN1 in a few days and replacing it with another WAN1. However, WAN2 is meant to become the new primary. What steps should I take to ensure that the Fortigate Firewall does this conversion properly? Do I need to take the Ethernet cables and swap them or is there a way to just switch the WANs in the system?

FortiGate

saneeshpv_FTNT

Staff

Hi,

Are using to SDWAN with WAN1 and WAN2 in your deployment ?

If SDWAN is used with WAN1 and WAN2, where WAN1 is primary member, if WAN1 fails traffic should shift to the next available member which is WAN2 and you can remove them from SDWAN Zone. Once WAN1 is back you can add them to SDWAN Zone and create rules to steer the traffic to WAN1 or WAN2 depending on your requirement.

If SDWAN is not used, you need to play around with policy route to control traffic flow.

Regards,

rittermAuthor

New Member

For whatever reason, SD-WAN is not in use, currently. As to why that is, I have no idea. What would you suggest I do?

saneeshpv_FTNT

Staff

Hi,

You can still work around all the possible suggestion provided in the Forum. But if you are planning to migrate to SDWAN, we have this option called "Integrate Interface" which would help you migrate to SDWAN without much of hurdle, but still a proper planning is required form your side. I would recommend this as this will help you stabilize your policy in a long run, as you will referring the SDWAN Zone instead of individual interfaces in the Firewall policies and you can control all your WAN steering with SDWAN rules with or without SLA's depending on your requirement.

Reference: This feature available in 7 onwards if I am not wrong.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Migrate-Physical-Interface-to-SDWAN-zone/ta-p/216358

Regards,

Toshi_Esumi

SuperUser

Deploying/converting to SD-WAN would take proper learning and planning. If it's just a temporary situation losing wan1 I would just make sure the failover to wan2 would happen by testing it manually, like pulling the cable from wan1, in a maintenance window.

But prior to that, I would check:

1) two default routes to wan1 and wan2 are set to failover, either static routes with priorities or pppoe/dhcp with different distances on the interfaces.

2) policies are allowing toward wan2 as well as wan1.

When you test it, you likely need to use CLI to troubleshoot like checking routing table, sniffing traffic toward wan2, etc. So if you haven't used CLI before you need to get yourself familialize before testing.

Toshi

Toshi_Esumi

SuperUser

I guess I misread your original statement. You wan to make wan2 as primary then wan1 as secondary.

But what you need to do is the same. Just reverse the role between them. Set the two default routes properly and the policies are allowing both interfaces.

Toshi

rittermAuthor

New Member

In what way do I officially reverse the roles? In the dashboard, the IP associated with the Firewall is associated with WAN1 so I'm assuming that it will have to change too. I believe the policies already allow for both interfaces. What confuses me about how this was originally created was that not all of the policies for each WAN are the same.

Toshi_Esumi

SuperUser

Are you talking about an additional public IP subnet from the ISP? Or the interface IP? Not sure what you meant by "associated".

Toshi

Toshi_Esumi

SuperUser

Again, the first thing to check is how two default routes are set currently. Static routes or dynamic(PPPoE/DHCP) default routes?

rittermAuthor

New Member

They are both static routes with nothing listed in the destination field but with a Public IP listed in the Gateway Address field.

Toshi_Esumi

SuperUser

If both static, you need to check the routing table in CLI. "get router info routing-table all".

At the top of the output there should be routes similar to mine. But I have SD-WAN set up so yours should be a little different:

fg40f-utm (root) # get router info routing-t all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP        O - OSPF, IA - OSPF inter area        N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2        E1 - OSPF external type 1, E2 - OSPF external type 2        i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area        * - candidate default   Routing table for VRF=0 S*      0.0.0.0/0 [1/0] via x.x.x.x, ppp3, [1/20]                   [1/0] via y.y.y.y, a, [1/1]

Just share those last two lines above by changing the public IPs.

kaman

Staff

For the redundant Internet connections, both the default static routes have to be active in the routing table.
So, in order to achieve it, set the distance of both routes the same.

If wan1 is to be the primary link [active link], then set the lowest priority to that link.
And highest priority to the other wan interface.

When there are multiple routes to the same destination with the same distance then the priority will be checked.
And the route with the least priority will be given preference.

Please refer to the below document:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Redundant-Internet-connection-without-load/ta-p/197694

R

Rajneesh

Staff

So basically you want your traffic to be routed via the WAN2.

If you will remove the cable from WAN1 and replacing with the new WAN then you can adjust your default route and give the new gateway IP in the existing default route.
Also to prioritize the WAN2 to be used you can create one more default route and give the lower priority then it will be given priority.

However I would recommend using SD-WAN to achieve this and use the manual mode in the sd-wan rule.

Refer this link for static route guidance >
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Default-route-configuration/ta-p/194613

rittermAuthor

New Member

So this morning, I took the WAN1 cable. Seems to be no downtime so far.

This is the current configuration (I didn't change anything yet):

Static Route WAN1:
Subnet
Gateway Address: PublicIP
Interface: WAN1
Administrative Distance: 5
Priority: 0

Static Route WAN2:
Subnet
Gateway Address: PublicIP
Interface: WAN2
Administrative Distance: 10
Priority: 0

rittermAuthor

New Member

I changed the Admin Distances to be the opposites. I'm still leaving the WAN1 cable out for now.

WAN1 is getting replaced by a new Internet service but it's meant to be the backup. As is, can I just insert the new Backup Internet into the WAN1 port and it will still remain the backup?

kiran1_naik

New Member

Just need to maintain the Distance value to lowest.

GO to > static route > distance (lowest distance will be primary wan link)

rittermAuthor

New Member

An update from me: So twice over the last couple weeks, the new WAN2 which is the primary has gone down. The WAN1 which is now the secondary doesn't bring the Internet up at all despite being connected. What should my next steps be? To fix this, I reboot the router and unplug the WAN2 cable and plug it back in.

Toshi_Esumi

SuperUser

You needed to troubleshoot when the problem was happening. Now you need to take the wan2 down to simulate then check routing why it doesn't go to wan1. I don't remember if I mentioned this before any more since it's been quite some time but make sure you have

config system global   set snat-route-change enable  (by default it's disabled) end

configured in CLI. Otherwise, on-going SNAT sessions won't fail over.

Actually the easiest way to troubleshoot is calling in to TAC if you have control to re-create the situation.

Toshi

Toshi_Esumi

SuperUser

Wait. Did you swap the admin distance between wan1 and wan2? Priviously wan1 was primary and admin distance was 5 while wan2 had 10. Since wan2 is now primary you need to swap them.

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO