Technical Tip: SD-WAN interface as HA ping server monitor interface

[subramanis]

Description
Remote Link Monitoring can be used to detect a remote failure, either on a remote link or remote equipment, and potentially trigger a cluster fail over to avoid a traffic interruption.
The only interface defined in the link-monitor can become HA ping server monitor interface

the Link-Monitor cannot be configured for those interfaces which is part of SD-WAN members

Solution
The link monitor feature is replaced by performance SLA for SD-WAN member interfaces in 6.2 and higher version, so now the SD-WAN interfaces can now be set as HA pingserver-monitor-interface and triggers HA failover when health check interface fails.

1) Before enabling the performance SLA.

The WAN1 interface is configured as a SD-WAN member interface.

FGT-Primary # show system virtual-wan-link
# config system virtual-wan-link
    set status enable
    # config members
        edit 1
            set interface "wan1"
            set gateway 10.109.31.254
        next
    end
end

The WAN1 interface is not visible in the link-monitor configuration once it is added as a SD-WAN member.

FGT-Primary (link-monitor) # edit ISP1_Link_monitor
new entry 'ISP1_Link_monitor' added

FGT-Primary (ISP1_Link_monitor) set srcintf
<string>        <----- Input string value.
dmz(ISP2)       <----- Interface.
ha1             <----- Interface.
ha2             <----- Interface.
lan             <----- Interface.
wan2            <----- Interface.

There is no link monitor has configured so it is not possible to add any interfaces in HA pingserver-monitor-interface configuration.

GT-Primary # show system link-monitor
# config system link-monitor
end

FGT-Primary # config system ha
FGT-Primary (ha) # set pingserver-monitor-interface ?
monitor    interfaces that has ping server enabled:


2) After enabling the performance SLA.

Health check for the WAN1 interface.

FGT-Primary (ISP1_sdwan_Link_~tor) # show
# config health-check
    edit "ISP1_sdwan_Link_monitor"
        set server "8.8.8.8"
        set ha-priority 5
        set members 1
    next
end

Now the WAN1 interface can be set as HA pingserver-monitor-interface after enabling the performance SLA (health check).

FGT-Primary (ha) # set pingserver-monitor-interface?
monitor         <----- Interfaces that has ping server enabled.

wan1(ISP1)      <----- Interface.
FGT-Primary # show system ha
# config system ha
    set group-name "HA"
    set mode a-p
    set password ENC xkPVVW4xhQSLl1gkrCMGFQr6Pjj81xXl4dG82tykOXIY1fzpyM8G0Qg1LaFe0jryLAUq2cmGco8ZZPplVUYvLfBAGKK0Qsj+kVwETWvP+q0iQgkwzxU7rBA/0UKjRgvPzpM44dNUUBWBGvtptFT2ihUkC+gQTLMb6hRee3Q3Ba/jF6VDZYD1oo08z2nXYiWtwh2sdQ==
    set hbdev "ha2" 0
    set ha-mgmt-status enable
    # config ha-mgmt-interfaces
        edit 1
            set interface "mgmt"
            set gateway 10.109.63.254
        next
    end
    set override disable
    set priority 150
    set pingserver-monitor-interface "wan1"
end

Related Articles.

Technical Tip: Combining Remote Link Monitoring with FGCP cluster High Availability

HA Remote IP Monitoring