Description
This article describes the functionality of 'set update-cascade-interface' when configured under 'config health-check' in SD-WAN.
When you enable Cascade Interface and configure one or more alert interfaces, one of the following events will occur;
- FortiGate brings down the alert interfaces if all members are dead.
- FortiGate brings up the alert interfaces if there is at least one alive member.
Related documentation:
Configure redundant internet connections using SD-WAN (formerly virtual WAN link).
Scope
FortiGate.
Solution
As a first step, 'update-cascade-interface' cannot function independently and it works with fail-detect' that needs to configured under 'config system virtual-wan-link'.
config system virtual-wan-link
set status enable
set fail-detect enable
set fail-alert-interfaces "internal3"
config members
edit 4
set interface "wan2"
set gateway 192.168.0.1
next
edit 1
set interface "wan1"
set gateway 192.168.0.1
next
end
config health-check
edit "8.8.8.8"
set server "8.8.8.8"
set update-cascade-interface enable
set members 4 1
next
end
end
In the above example, when health check for wan1 and wan2 fails, i.e. if we cannot reach the configured “server” at 8.8.8.8, the internal3 interface would be disabled as defined in fail-alert interface. This is shown in the this output:
Testing and examples:
The status shows alive:
diagnose sys virtual-wan-link health-check
Health Check(8.8.8.8):
Seq(4): state(alive), packet-loss(3.000%) latency(19.610), jitter(14.388) sla_map=0x0
Seq(1): state(alive), packet-loss(3.000%) latency(20.623), jitter(14.182) sla_map=0x0
Internal3 interfaces also show as up:
diagnose hardware deviceinfo nic internal3
========== Link Status ==========
Admin :up
netdev status :up
link_status :Up
Health-check failure:
diagnose sys virtual-wan-link health-check 8.8.8.8
Health Check(8.8.8.8):
Seq(4): state(dead), packet-loss(85.000%) sla_map=0x0
Seq(1): state(dead), packet-loss(73.000%) sla_map=0x0
Internal3 interfaces are taken down as well:
diagnose hardware deviceinfo nic internal3
========== Link Status ==========
Admin :down
netdev status :N/A
link_status :Down
Note:
Verification of this can also be done via GUI under Log & reports -> Events.
Below is a setup example where Cascade Interface may be used:
In this case, if both members of SDWAN are down, port3 as the cascade interface will go down. This will make the switch consider that path as 'dead', meaning it will therefore send traffic to the other device and to the internet.
