Scenario:
2 WAN links to different ISPs on a Fortigate firewall using a static route for each WAN link, equal cost/distance, different priority. No dynamic routing - very simple topology.
This allows me to ping both interfaces on the Fortigate to monitor remotely that BOTH ISPs are up and functional. This also prefers traffic out the interface that is weighted with the appropriate priority.
Using link-monitor CLI functionality to ping 8.8.8.8 on WAN links to monitor for WAN failure so the static route is removed from the routing table as appropriate during WAN link failure.
Issue:
During WAN link failback, e.g. WAN1 becomes available again after an outage, any existing sessions passing through WAN2 remain on the WAN2 interface. This becomes problematic with my VoIP traffic which runs over the internet. I want all sessions to be cleared on WAN2, and new sessions to establish out WAN1. Instead, existing sessions persist through WAN2 - particularly my VoIP sessions using SIP - in this scenario I do NOT want the sessions to stay up through WAN2 but be torn down. WAN2 is often a less preferred link with lower bandwidth or higher latency so I do not want sessions to persist on this interface.
In summary - I want to have both WAN interfaces pingable on the Fortigate (which seems to require an equal route cost) so I can monitor reachability of the firewall through both ISPs on WAN1 and WAN2. I want to utilize WAN2 for failover, but I do NOT want my existing sessions to persist on WAN2 once WAN1 comes back up.
Is there a way to achieve the above using say SD-WAN functionality or some type of macro on the Fortigate device or any other method?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Quick bump on this - anyone?
I'm having a similar issue with VOIP if anyone has got any great ideas for killing sip sessions on the less preferred link following primary link restoration?
Cheers
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1547 | |
1031 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.