VRRP active failover and VRRP with 3rd party router

Forum|Forum|5 years ago
July 1, 2021
2 replies
5305 views

Hi all,

you can see the network diagram.

I found out that active failover is not working when I do VRRP with a FortiGate appliance (60F) and a H3C router.

On the FortiGate (Master):

config system interface

edit port1

config vrrp

edit 1

set vrip 192.168.1.1

set priority 255

set vrdst 8.8.8.8

set vrdst-priority 10

[ul]

when the monitoring target specified in vrdst (i.e. the 8.8.8.8) is down (in my case it is because the upstream host having issue), the VRRP priority of it has not changed to the value specified in the "set vrdst-priority"[ul]

FGT[WAN1] --[ISP1]- x -Internet H3C[WAN2] --[ISP2] --Internet[/ul]

therefore, the end user will keep going to the FortiGate instead of the H3C router.[/ul]

I heard this feature only works on 2 FortiGate forming VRRP, but I proved it fails too in my lab with 2 FortiGate appliance.

SO, have everyone tried the active failover and succeeded before?

Please help.

Untitled Diagram.png

Best answer by Toshi_Esumi

I don't remember well when I was testing this years ago and decided not to use. But VRRP's vrdst setting doesn't cause the FGT to ping the destination. It monitors the route to the destination instead. I'm not sure if it's specified in the RFC. Below KB uses a blackhole route but needs the interface(vpn) do go down. I would suggest you try combining a link-monitor to take the static routes down including the default route.

https://kb.fortinet.com/kb/documentLink.do?externalID=FD44632

Toshi_EsumiAnswer

SuperUser

I don't remember well when I was testing this years ago and decided not to use. But VRRP's vrdst setting doesn't cause the FGT to ping the destination. It monitors the route to the destination instead. I'm not sure if it's specified in the RFC. Below KB uses a blackhole route but needs the interface(vpn) do go down. I would suggest you try combining a link-monitor to take the static routes down including the default route.

https://kb.fortinet.com/kb/documentLink.do?externalID=FD44632

pcgAuthor

New Member

Thanks, Toshi.

In fact, I am using link monitor currently in my production environment as a workaround (either remove the default route or bring down the VRRP master's participating interface).

I have never seen the document you put before, thank you. I feel that the active failover is bugged when the vrdst IP address is using the default route and Fortinet couldn't care less.

I tried contact their TAC but you already know what they said.

Hope this post can help others who are looking for a VRRP active failover troubleshooting solution.

Sign up

Login with SSO

Login to the community

Login with SSO