Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
catalin_alexandru
New Contributor

WAN connection Link-Monitoring

Hello. 

I have a Fortigate 60E with 2 WAN connection. One is static IP (wan1 - main), other is PPoE (wan2 - backup).

 

 

S* 0.0.0.0/0 [10/0] via 89.xxx.xx.253, wan1, [1/0]                    [10/0] via 82.xx.xxx.1, wan2, [2/0] C 10.0.0.1/32 is directly connected, ppp1 C 82.xx.xxx.30/32 is directly connected, ppp1 C 89.xxx.xx.252/30 is directly connected, wan1 C 192.168.100.0/23 is directly connected, internal

 

Same distance, and different priority.

I try to configure link-monitor, when wan1 is down, all user inside my network get out traffic using wan2:

 

config system link-monitor edit "wan1 Failover" set srcintf "wan1" set server "8.8.8.8" set gateway-ip 89.xxx.xx.253 set update-cascade-interface disable next edit "Wan2 Failover" set srcintf "wan2" set server "8.8.8.8" set gateway-ip 82.xx.xxx.1 set update-cascade-interface disable next

Is the correct setting? 

 

Best regards!

 

8 REPLIES 8
orani
Contributor II

Why don't you try SD-WAN?

Orestis Nikolaidis

Network Engineer/IT Administrator

Orestis Nikolaidis Network Engineer/IT Administrator
catalin_alexandru

Because i already have a lot of IPv4 policy and i have to reconfigure all. This is not an option.

On show the question is: 

 

set update-cascade-interface (enable or disable )?

set update-static-route (enable or disable) ?

 

 

orani

What about policy routing?

Orestis Nikolaidis

Network Engineer/IT Administrator

Orestis Nikolaidis Network Engineer/IT Administrator
catalin_alexandru

How to use policy route for wan redundancy? :)

I remain to my main request, in link-monitor :

 

    set update-cascade-interface (enable or disable )?     set update-static-route (enable or disable) ?

 

Thank you !

brycemd

disabling the cascade is fine, and enable update-static-route which is default anyways.

 

What you posted should work, however you likely don't need a monitor for WAN2. Since WAN1 is your primary, WAN2 will never be active unless WAN1 fails. So monitoring it to remove the route isn't really needed

 

Also, even though it's not SD-WAN, the link monitor status can be seen in Monitor > SD-WAN(depending on what version you are on it may be called something else)

Toshi_Esumi

FYI: "diag sys link-monitor status" in CLI

catalin_alexandru

Thank you for your answer. 

It's harder to do connection tests because the system is in production almost 24 out of 24. I will delete the monitoring for wan2, unless it makes sense for the main one to be.

I monitor ping to the DNS server of  my provider. On Google DNS servers sometimes timeouts appear for a few seconds, enough for the system to set the main route down. What do you think, use gateway or dns provided by provider or google dns / open dns?

Lucascat

You can use multiple IP to monitor the link status...

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors