Skip to main content
R1chou
R1chou
New Member
August 24, 2021
Question

Zone - Link monitor ?

  • August 24, 2021
  • 1 reply
  • 2128 views

Hello,

 

I have 2 differents sites, I must join site B from site A and site A from site B. I have 1 MPLS connection between these two sites (site to site) with one network equipement on each side. I have 1 VPN IPSEC connection between these two sites. MPLS and IPSEC interfaces are members of a Zone.

Administrative distance for both is setup to 10. Priority for IPSEC is 10 and 5 for MPLS.

 

I am located to the site A which is managed by my Fortigate 200E. The site B is managed by a Cisco ASA.

 

What I want it's to use MPLS first and if it's down for any reason use the IPSEC.

My problem is : If I simulate a failure by deactivating MPLS from site A, it's ok my Forti switchs to IPSEC but If i simulate a failure to the site B, my Forti continues to use MPLS beacause ( I think) the one on site A is still reachable.

 

How could I tell to Forti that if MPLS equipement on site B it's not reachable use the IP SEC ?

 

Regards,

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    August 24, 2021

    When you take MPLS down on Site B side, the interface on the 200E is still up and routing won't change on the FGT.

    As you already hinted yourself, you should use link-monitor over MPLS pinging the other end. It take those static routes out when it detects circuit down.

    https://kb.fortinet.com/kb/documentLink.do?externalID=FD44679

     

    Terms & ConditionsAccessibility statement