| Description |
This article describes how to configure wan1 as a static interface and wan2 as DHCP interface and set up an ISP failover between them. |
| Scope | FortiGate, v7.x. |
| Solution |
Configuring the interfaces.
To configure wan1 as static, Enable SD-WAN, and add wan1 : Go to Network -> Interfaces, select the WAN port to configure, set the Addressing mode as 'Manual', enter the 'IP/Netmask', and select 'OK'.
To configure wan2 as DHCP: Go to Network -> Interfaces, select the WAN port to configure, set the Addressing mode as 'DHCP', enable 'Retrieve default gateway' from the server and then select 'OK'.
Note: If SD-WAN is not used, adding a DHCP interface may interfere with the default route and interrupt Internet-bound traffic. This is because the default static route (if not customized) has an administrative distance (AD) of 10 and a priority of 1. However, the DHCP route has an AD of 5 and a priority of 1, which makes it the preferred route.
Therefore, it is important to set the correct distance and priority values on the DHCP route. This can be configured via the GUI or CLI. A manual static route does not need to be added for a DHCP interface.
FortiGate automatically adds a route once the DHCP interface receives an IP address and gateway information
config system interface edit wan2 set distance <Integer Value> set priority <Integer Value> next end
To set up the ISP failover between two WAN interfaces, an SD-WAN will be used.
To create the SD-WAN interface: Go to Network -> SD-WAN, under SD-WAN Zones, select Create New -> SD-WAN member.
Adding wan1 (Static): Select wan1 and select the zone as virtual-wan-link, set the default gateway as set when configuring the interface, and select 'OK'.
Adding wan2 (DHCP): Select wan2 and select the zone as virtual-wan-link. Do not change the default gateway and select 'OK'.
To add the Default Static Route: Select the virtual-wan-link from the Interface, set the Destination as 0.0.0.0/0.0.0.0, and select 'OK'.
Verifying the routes in the route table: It is possible to verify the routes have been added using with the following command:
get router info routing-table all
Creating an ISP failover: Go to Network -> SD-WAN -> Performance SLA, select 'Create New', set the Name as Link-Monitor, set Probe as Active, set Protocol as Ping, add 8.8.8.8 as the Server, enable Update static route and then, select 'OK'.
Related article: |
