FAILOVER WITH 2 INTERNET LINKS ON A SINGLE FIREWALL

[gerini]

Hello guys,

I need help, i have a fortinet 100f and i need to have HA, when i lost a internet link, i need that switch the trafiic automatic for the other interface. I have only one firewall and i works with the same internet links at same time.

For Wan 1 im using for web traffic and Wan 2 for a vpn site to site.

Please you help for have 

[Toshi_Esumi]

So, you're NOT talking about "FortiGate HA", which requires at least two of the same FGT model. But talking about "fail-over" from 1) wan1 to wan2(web traffic), and 2) wan2 to wan1(site2site VPN). 

If you're not interested in learning FGT SD-WAN configuration/operation, for 1), you can set up another static default route with lower priority (high priority value) on wan2 if you haven't done it yet for the site2site VPN. Then run a link-monitor against wan1 to detect the failure then remove the current static default route (has to be static though).

For 2), it depends on the capability of the remote end but a basic way is to have two tunnels from both wan1 and wan2 to the remote end then set up static routes to the other end toward both tunnels but wan1 side has higher distance (lower priority). You have to do that on both ends of the tunnels. Then primary IPsec goes down (when the wan2 link goes down) the primary static routes should disappear and higher distance routes would take over. 
You can of course use routing protocol like BGP or OSPF for site2site route advertisement. But it requires the other side's support of the protocol you choose.

Toshi

[gerini]

Hello Toshi,

My current configuration is:

One Firewall 100f with 2 Wan Links each connected to Internet with differents ISPS.

Interface wan1 Is my main link to intenet and pass all web traffic its has a 500 Mgbs of speed.

Interface Wan 2 is used to connect another site by vpn site to site and has 100 Mgbs of speed

The static routes are for both a distance of 5 and Priority 1 for wan 1 and Priority 2 for Wan2.

I have a main policiy for internal web traffic for wan1

and have disbale a second policiy for web traffic for wan2.

In this moment are working at same time each link. So i need to have HA or redundancy in the links when wan 1 goes down automatic swicth the web traffic for wan 2,

How can i do that?? Do you have some manual ?? I need to implement SDWAN?

[Toshi_Esumi]

You have proper static default routes with priority to both internet interfaces. If you unplug the cable from wan1 (Layer1/layer2 down), the general internet traffic should failover to wan2 even now. If you want to make sure it would failover when Layer3 reachability goes down (like ISP's internal failure), you just need to add link-monitor to like 8.8.8.8 or other IP on internet through wan1 then remove either all static routes to wan1 or specifically 0.0.0.0/0.0.0.0 static route to wan1. 
You can search over the internet like "FortiGate Link Monitor Configuration" as keywords. But Fortinet Admin Guide nowadays don't have the simplest example so below is another one:
https://marktugbo.com/2018/03/26/fortigate-set-up-the-health-link-monitor-and-configure-ping-servers...
This config would remove all static route toward wan1.

But you don't need to fail-over site2site VPN to wan1 then?

Toshi

[gerini]

Hello Toshi,

I dont see any option of my firewall for update routing table, please if you have some documentation for do this in sdwa i really appreccitte

tahnks

[Toshi_Esumi]

Not sure what you meant by "dont see any option of my firewall for update routing table".
The routing table is just the result of the link-monitor operation. The route would be removed automatically when the ping fails. Then would be recovered when the ping is restored.

For SD-WAN, it's a big/new feature that you need to learn a lot before even start configuring the zone members (wan1, wan2). Read through admin guide of your version to understand the concept how it would work first.
https://docs.fortinet.com/document/fortigate/7.4.8/administration-guide/19246/sd-wan

Toshi