Skip to main content
a11smiles
a11smiles
New Member
June 9, 2023
Solved

Please help verify priority

  • June 9, 2023
  • 1 reply
  • 2093 views

Using FortiGate 80F with Fortinet OS 7.4.0.

 

I am configuring dual WAN. I want my primary (WAN1) to be used whenever the health link is alive. My secondary (WAN2) should only be used while WAN1 is down (dead). As soon as WAN1 comes back alive, I want my traffic to be rerouted immediately through WAN1.

 

Again, I always want to use WAN1 when its health is alive.

 

Here is my configuration. Can someone verify it and let me know if something needs to be changed?

 

 

config system link-monitor     edit "wan1 failover"         set addr-mode ipv4         set srcintf "wan1"         set server-config default         set server-type static         set server "8.8.8.8"         set protocol ping         set gateway-ip 0.0.0.0         set source-ip 0.0.0.0         set interval 3000         set probe-timeout 500         set failtime 3         set recoverytime 3         set probe-count 30         set ha-priority 1         set update-cascade-interface enable         set update-static-route enable         set update-policy-route enable         set status enable         set diffservcode 000000         unset class-id         set service-detection disable     next     edit "wan2 failover"         set addr-mode ipv4         set srcintf "wan2"         set server-config default         set server-type static         set server "8.8.8.8"         set protocol ping         set gateway-ip 0.0.0.0         set source-ip 0.0.0.0         set interval 3000         set probe-timeout 500         set failtime 3         set recoverytime 3         set probe-count 30         set ha-priority 1         set update-cascade-interface enable         set update-static-route enable         set update-policy-route enable         set status enable         set diffservcode 000000         unset class-id         set service-detection disable     next end

 

 

Thanks!

Best answer by Toshi_Esumi

You don't need the second part if wan1 is primary. As long as wan1 side is up, nothing needs to be done when wan2 goes down.
Just make sure you have below set.

config system global   set snat-route-change enable  (by default it's disabled) end

 

Toshi

1 reply

Toshi_Esumi
SuperUser
Toshi_EsumiAnswer
SuperUser
June 9, 2023

You don't need the second part if wan1 is primary. As long as wan1 side is up, nothing needs to be done when wan2 goes down.
Just make sure you have below set.

config system global   set snat-route-change enable  (by default it's disabled) end

 

Toshi

a11smiles
a11smilesAuthor
New Member
June 9, 2023

Thanks, one other question...

 

Do I need to configure static routes as the documentation says:
(As you can see wan1 has a priority of 1, and wan2 has a priority of 2.)

 

 

config router static     edit 1         set device "wan1"         set dynamic-gateway enable     next     edit 2         set priority 2         set device "wan2"         set dynamic-gateway enable     next end

 

 

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
June 9, 2023

Don't have to be static default routes. But you have to make wan1 default route win over the wan2's. If they're dhcp or pppoe, you need to set a higher distance on wan2 interface. The priority works only with static routes.
If you want to use static default routes instead, you need to "set defaultgw disable" on the interfaces.

In any case I would recommend you test it for multiple failure scenarios. Once it's set up.

 

Toshi

Terms & ConditionsAccessibility statement