Changing route based on WAN down detection

[subashcobi]

Hi All, I pretty new to Fortigate, so appreciate all the advise i can get. I have a setup whereby i' ll need to route traffic to a different route if the WAN link is down. WAN----FortiGate---Internal Network So all traffic for 172.0.0.0/8 will be routed to the WAN route. IF the WAN router MPLS fails, i' ll need the FortiGate to route the traffic back to the Internal Network, where it will take another route out. This is what i came up with: IP/Mask Gateway Device Distance Dead Gateway 172.0.0.0/8 MPLS router VRRP IP Port 1 (outside) 5 WAN Router MPLS IP 172.0.0.0/8 Internal Network IP Port 2 (inside) 10 n/a So all 172.0.0.0/8 traffic route to MPLS router VRRP IP with distance of 5 till the dead gateway (WAN Router MPLS IP) is unreachable, then it route to Internal Network IP. But then when the dead gateway (WAN Router MPLS IP) is reachable back, all 172.0.0.0/8 traffic will route back to the MPLS router VRRP IP. Will this work, or is there any other better way to do it. Thanks, Subash

[ede_pfau]

Both routes should have the same distance but different priorities. In FortiOS, " priority" translates into " cost" . So the backup route should have a higher priority. Failover and failback will be automatic. To make the Fortigate aware of a failure you configure ping hosts (a.k.a. Dead Gateway Detection) as you already did. You don' t have to configure that on the backup interface. Of course you need a set of policies allowing this redirected traffic out WAN2. You will probably not need to enable NAT here as the traffic goes to an internal router. To make your life easier you can put both interfaces (WAN1, WAN2) into a zone (e.g. " OUT" ) and create policies from ' internal' to ' OUT' . Then you will only need one set of policies, and you won' t have to keep two sets in sync.

[subashcobi]

Thanks for the explanation on " priority" . Will take note on that. You mention i' ll need a set of policies allow the redirect, what do you meant by that.. Would it be sufficient if i have these 2 routes under the routing portion: 1) IP/MASK:172.0.0.0/8 Gateway: WAN router VRRP IP Device: Port 1 (outside) Priority: 5 Dead Gateway IP: WAN router MPLS IP 2) IP/MASK:172.0.0.0/8 Gateway: Internal network IP Device: Port 2 (inside) Priority: 10 I don' t think i can put both the interface' s into a zone, cause my port 2 is also the inside port from internal network to FortiGate. Just that during the WAN outage, the WAN traffic will get routed back to the internal network which then gets carried over to another building WAN router via a long single mode fiber.

[ede_pfau]

It' s OK if the zone construct seems too complicated. You can do without. What I mean with ' second set of policies' is that routing alone will only determine which interface traffic will be directed to. As this is a firewall you will additionally need a policy to allow traffic. Dumb as I am I' ve overlooked that you are redirecting INTERNAL traffic only. As this traffic doesn' t cross a firewall interface you do not need additional policies here. Sorry (it' s either the high temperature in my office or just my age...).

[subashcobi]

Great. Thanks Ede.

[rwpatterson]

Because the second route (internal) doesn' t pass through a port on the FGT, you may not have success getting the failover to work. The failover would have to occur on each box that needs it as opposed to having the firewall do it. Not a great design in my opinion. I would really try to get that second exit path placed onto a [unique] port on the firewall.