Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
bhagat_sudhir
New Contributor

Session Getting Disconnected - Failover

 Hello All, 

 

 

We have 02 MPLS links from different ISPs termination on Fortigate HA (A-P) with eBGP. We were testing failover between two ISPs result is successfull (with AS path prepend and Local preference).

 

But failover is taking  time (approx 2-3 minutes) from primary to secondary link. due to which all critical established session (voice) got disconnected. 

 

Could anyone pl let us know what exactly need to be done to decrease the failover  time effectively so that already established session should not be impacted.

 

Rgds

 

 

 

 

 

 

2 REPLIES 2
Istvan_Takacs_FTNT

Hello Bhagat,

 

As I understand you're not failing over the the standby unit, but only from wan1(isp1) to wan2(isp2).

In such case (even if wan2 is connected only to the standby) the default BGP convergence time and sending the packets through a different path will cause the drop of the sessions.

You can limit the convergence time by changing some of the BGP values under 'config router bgp', like

 

fast-external-failover

graceful-restart-time

graceful-update-delay

holdtime-timer

etc.

 

By decreasing the default values on the above, you can shorten the time that requires for the detection of the failed peer or the failing over to the standby link.

 

You may also want to have a look at the "ebgp-multipath" option under the same. It's disabled by default, but you can use both links as active, load-balanced ones. If one of them goes down, it will be almost transparent for the end-users, only those sessions will be impacted, that are already established through the failed link.

bhagat_sudhir

Hello Istvan,

 

Perfect !!

 

If I understand correctly suggested 04 commands are configured under "config router bgp" and not under conifigure neighbour.

 

But still could you please share sample configuration example with above commands. that we can go for implement real time.

 

Also,ebgp multipath will be use when we have to make both or all links to behave as Active-Active(you also mentioned this), Would like to confirm , whether in fortigate only ebgp multipath command will solve our purpose or need to add some other commands too and this need to add under config router bgp OR under configure neighbour.