New Member

Question

Static route not working for 2nd ISP link

Forum|Forum|3 years ago
August 30, 2022
16 replies
7976 views

We are setting up static IPs from two ISP provider on one Forgitate 300.

The first ISP setup using default static route works, but adding the 2nd ISP doesn't.

Static routes and Policies are as follow

Static Routes :

0.0.0.0/0.0.0.0, GW: up.ISPa.169.229 using port 5 for ISP-A

0.0.0.0/0.0.0.0, GW: down.SVRa.38.80 using port 6 for Server-Segment-A

up.ISPb.100.28/255.255.255.252, GW: up.ISPb.100.29 using port 1 for ISP-B

down.ISPb.36.144/255.255.255.240, GW: down.SVRb.36.144 using port 2 for Server-Segment-B

Policies:

Port1 -> Port 2: all, NAT disabled

Port2 -> Port 1: all, NAT disabled

Port5 -> Port 6: all, NAT disabled

Port6 -> Port 1: all, NAT disabled

Should we abandon default route (0.0.0.0/0.0.0.0) and use ISP-A parameters instead?

Does the sequence of static route matter? i.e. by define it first will cause all traffic to route to default?

FortiGate

parteeksharma

Staff

Hi Yeehar,

As per the fortigate behavior the distance and priority value matters in the selection of the static route. The static route having lower distance will be preferred. When two routes have an equal distance, the route with the lower priority number will take precedence.

Best regards,
Parteek

A

Anonymous_User

Contributor III

Hello Yeehar,

You can check this below document for more information on routing behavior

https://community.fortinet.com/t5/FortiGate/Technical-Note-Routing-behavior-depending-on-distance-and/ta-p/198221

* In general terms whichever route AD value is less will be in the routing table others will not

* If two routes have the same AD value and Priority is same then the firewall will do ECMP, to have redundancy change the Priority in the route setting

To check routing use the below command:

get route info routing-table database --> to check active and inactive both routes

get router info routing-table details --> It will show active route which firewall will use to send traffic.

Regards,

sgClarenceAuthor

New Member

Hi Vishal Sahu,

We are trying to combine two edge routers giving by two different ISP into a single Fortigate, is this possible?

We have tried specifying two static routes.

When only one ISP is connected, the route works for each ISP configuration.

However, when both were plug in, all access are blocked, i.e, we tried to ping from mobile phone to the static IP provided by respective ISP.

Thanks for trying understand our attempts.

A

Anonymous_User

Contributor III

Yeehar,

* Your topology will work if the route and policy configuration is correct, make sure NAT is enabled in both the policy that you've configured for WAN1 and WAN2.

Can you share the output of, when both routers are connected

get route info routing-table database

get router info routing-table details

show router static

A

Anonymous_User

Contributor III

Hello Yeehar,

The configuration is correct you can take a flow filter and snifer when both the links are connected and check where it's getting dropped, or firewall is sending the traffic to the next hop or not.

> First enable the flow filter in one SSH and Sniffer in another session simultaneously

> Then initiate the ping to 8.8.8.8

Flow filter:

diag debug disable
diag debug reset
diag debug flow filter clear
diag debug flow filter saddr x.x.x.x
diag debug flow filter daddr 8.8.8.8
diag debug flow filter proto 1
diag debug flow show iprop en
diag debug flow show fun en
diag debug flow trace start 1000
diag debug enable

Sniffer:

diag sniffer packet any "host x.x.x.x and host 8.8.8.8 and proto 1" 4 0 a

sgClarenceAuthor

New Member

Hi Vishal Sahu,

We didn't quite follow 8-(

we started a SSH session to setup the diagnostic settings at source address 29.51.38.81 followed by diag sniffer packet any "host 29.51.38.81 and host 8.8.8.8 and proto 1" 4 0 a.

Then at the CLI console in the web interface, we did a ping 8.8.8.8.

We are doing while single ISP connection is active to test if we are setting up correctly.

There wasn't any result displayed at the SSH session.

Are we doing it right?

rosatechnocrat

Explorer III

Dear sgclarence,

You can use the SDWAN feature to achieve this. If you configure SDWAN you will be able to load balance the traffic between both the links and also can utilize the links based on latency or the applications.

Subscribe "ROSA Technocrat" on Youtube for Fortinet Videos and Troubleshooting https://www.youtube.com/@rosatechnocrat

sgClarenceAuthor

New Member

Hi Rosatechnocrat,

SDWAN seems to be an overkill for consolidating two ISP edge routers on a single Fortigate.

A

Anonymous_User

Contributor III

You can follow the below guide for reference:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Using-the-FortiOS-built-in-packet-sniffer/ta-p/194222
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Packet-capture-sniffer/ta-p/198313

You can use this command but it will show any traffic for ping to 8.8.8.8

diag sniffer packet any "host 8.8.8.8 and icmp" 4 0 a

sgClarenceAuthor

New Member

Hi Vishal Sahu,

We managed to observe ping results using one ISP connectivity via Port5/6 set and will try again during weekend with both ISP services connected 8-)

We've configured Port 7 as 192.168.1.99 with DHCP enabled.

At static route, a new entry 192.168.1.99/255.255.255.255 is pointing to 29.52.38.81 (port 6) as gateway and the earlier policy forwards all traffic from port 7 to port 6 with NAT enabled.

However, internet is not accessible.

Any idea what additional rules might be required on Fortigate?

Thanks again for your suggestion.

A

Anonymous_User

Contributor III

Hello Yeehar,

Can you elaborate on the section "At static route, a new entry 192.168.1.99/255.255.255.255 is pointing to 29.52.38.81 (port 6) as gateway."

As enabling DHCP has nothing to do with the route also you're enabling the DHCP on port 7 so why the route will be pointing to port 6?

Also for internet traffic flow a policy from LAN to WAN is required with NAT enabled and a route is required so your setup seems correct only when both the links are there need to check the traffic flow using sinffer and flow filter

Sign up

Login with SSO

Login to the community

Login with SSO