probe-response

Back to my questions

Because its related to network reliability

 

QUESTIONS

1. If I have 2 WAN link.

Do you think I need to use port1 and port2 as my WAN link, because only those ports, I can turn on probe link.

Another reason is because reliabilility usually related to WAN link. LAN link mostly always reliable compare to WAN link.

 

2. In what situation I need to turn on probe-response

Do you think its usefull when branch using FG using ISP2 while HQ using ISP1

Do you think, I need to turn it on all the times

 

3. After I do

config sys probe-reponse

set mode http-probe

end

What else I need to do to verify that probe-response work

 

tq

 

Jeff_FTNT wrote:

" probe-response " is like  "Cisco IOS IP SLAs" feature.

If you set up FGT with CLI:config sys probe-reponse/set mode http-probe/twamp/end

Enable allowaccess for "probe-response" on interface, it will response request from other remote FGT, so remote FGT can use it as link-monitor or reachable detect, thanks.

Based on your reply better to detect public web server

Let say I have scenario like this

HQ:

-2x web server NATted behind FortiGate and have public ip and have same dns name in round robin

 

BRANCH:

-set

WAN1 port: config system server-probe     edit 1         set server "X.X.X.X"         set srcintf "port1"         set protocol http-get         set url www.mywebserver.com     next end

 

QUESTIONS:

1. If branch FG detect link down to the web server, will it reroute its traffic to other web server ip

2. F5 can detect based on response.

Let say web service is not down but connection from web server to its database is down equal to service is down too.

Can FG detect failed based on respond not based on ping or port alive?

 

Jeff_FTNT wrote:

Mostly not need enable "PROBE-RESPONSE"  on FGT. It support http/twamp light only.

If you  need HTTP fail detect on FGT, you may point detect server to public web server.

Twamp only support "light mode".Thanks.