FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
akileshc
Staff
Staff
Description This article describes the configuration and verification status of a link monitor for a specific route.
Scope

FortiOS v7.0.1 and above

Solution

A link monitor could be used to selectively update a particular Interested route.

 

Link health monitoring detects the health of the link by sending the probing signals to a server and assessing link quality based on latency, jitter, and packet loss; this allows the routes associated with the monitored interface to be updated in the routing database.

 

When a link monitor fails, only the routes indicated in the link monitor can be withdrawn from the routing database,
rather than all routes that have the same interface and gateway. If no routes/subnets are specified, all routes are discarded.

 

Note: IPv4 routes are the only ones that are supported.

 

To configure the link monitor:

#config system link-monitor

#edit "1"
#set srcintf "lan"
#set server "10.150.7.218"
#set gateway-ip 10.150.7.218
#set route "1.1.1.0/24" "2.2.2.2/32"<Specify the routes
#next

#end

 

To check the results:

 

1. When the link monitor is alive:

 

# di sys link-monitor status

Link Monitor: 1, Status: alive, Server num(1), HA state: local(alive), shared(alive) <-
Flags=0x1 init, Create time: Sun Jan 9 09:32:35 2022
Source interface: lan (34)
Gateway: 10.150.7.218
Monitor subnet(2): 1.1.1.0/24 2.2.2.2/32 <-
Interval: 500 ms
Service-detect: disable
Diffservcode: 000000
Class-ID: 0
Peer: 10.150.7.218(10.150.7.218)
Source IP(10.150.4.58)
Route: 10.150.4.58->10.150.7.218/32, gwy(10.150.4.58)
protocol: ping, state: alive <-
Latency(Min/Max/Avg): 0.226/361.159/40.353 ms
Jitter(Min/Max/Avg): 0.000/360.920/40.125
Packet lost: 91.000%
Number of out-of-sequence packets: 0
Fail Times(0/5)
Packet sent: 9421, received: 518, Sequence(sent/rcvd/exp): 9422/9422/9423

 

# get router info routing-table details
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [10/0] via 10.5.63.254, mgmt
S 1.1.1.0/24 [10/0] via 10.150.7.218, lan 
S 2.2.2.0/24 [10/0] via 10.150.7.218, lan
S 2.2.2.2/32 [10/0] via 10.150.7.218, lan 
C 10.5.48.0/20 is directly connected, mgmt
C 10.10.10.0/24 is directly connected, dmz
C 10.150.0.0/20 is directly connected, lan

 

2. When the link monitor is dead:

 

# di sys link-monitor status

Link Monitor: 1, Status: dead, Server num(1), HA state: local(dead), shared(dead)
Flags=0x9 init log_downgateway, Create time: Sun Jan 9 09:32:35 2022
Source interface: lan (34)
Gateway: 10.150.7.218
Monitor subnet(2): 1.1.1.0/24 2.2.2.2/32
Interval: 500 ms
Service-detect: disable
Diffservcode: 000000
Class-ID: 0
Peer: 10.150.7.218(10.150.7.218)
Source IP(10.150.4.58)
Route: 10.150.4.58->10.150.7.218/32, gwy(10.150.4.58)
protocol: ping, state: dead
Packet lost: 100.000%
Number of out-of-sequence packets: 0
Recovery times(0/5) Fail Times(1/5)
Packet sent: 9316, received: 509, Sequence(sent/rcvd/exp): 9317/510/511

 

# get router info routing-table details
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [10/0] via 10.5.63.254, mgmt
S 2.2.2.0/24 [10/0] via 10.150.7.218, lan 
C 10.5.48.0/20 is directly connected, mgmt
C 10.10.10.0/24 is directly connected, dmz

 C 10.150.0.0/20 is directly connected, lan

Contributors