Failover WAN service

[Dustin]

Hello,

I'm using OS 5.4 on a 100D and the documentation / video support is somewhat vague when it comes to the WAN LLB configuration.

What I am trying to achieve is basically setup a failover WAN connection, WAN1 as primary and WAN2 as secondary.

It appears I can only use weighted options. So, in theory, I'll set WAN1 to 100% weight and WAN2 to 0% guessing that if WAN1 goes down WAN2 will take over.

Now the caveat, let's say I wanted to send specific traffic (VoIP) in/out WAN2 only, what would be the best solution?

Which "Load Balancing Algorithm" would be the best choice (Volume, Sessions, Spillover, Source-DestinationIP or SourceIP)?

Is the WAN LLB also aware if the WAN2 interface is down to failover to WAN1? 

I have tired configuring with WAN LLB Rule to send a source address going to a destination address out the WAN2 interface and tried configuring a Policy route with the same but doesn't seem to work. When I have the above configurations set traceroute still shows traffic going out the WAN1 interface.

I have WAN1 and WAN2 configured to 2 separate ISPs

There are Static routes for each WAN interface

The WAN LLB is set to Volume with WAN1@100% and WAN2@0% 

WAN LLB Rule is configured to send traffic from Source Address X to Destination Address Y and Any Protocol out WAN2 interface.

Finally, I do have some Policy Objects that basically repeat the WAN LLB Rule but selects the wan-load-balance interface as the Outgoing Interface.

Any suggestions? 

[Burhanripl]

Hello 

I was stuck with the same config. If you set the weight to 0 for any wan interface,, fortigate turns down that wan interface. Even the VIP created for that interface does not work. 

Work around would be to give minimum weight to that interface. For eg. 100 to wan1 and 1 to Wan2.

Solution : Change the priority for wan2 interface from cli

config system virtual-wan-link

config members

edit wan2(no.)

set priority 20

end

end

[Dustin]

Thank you so much for the suggestion.

I'm going to give it a try later today.

[echo]

For such cases, I haven't used any specific load-balancing method but just that the routing table has 0.0.0.0/0 twice, for primary isp interface distance 10 priority 10, for secondary distance 10 priority 20 -- in the case where I want to use both at the same time. And then, if the second ISP is not acting as backup for the first, I can use policy routes to send specific traffic through specific interface, or use the other interface eg for (some) ipsec tunnels. But if one isp internet goes down, then it depends on policy route details and other configuration if continue working or not.

For the rest of the configuration, let's say outgoing internet, I have zone called untrust and both isp's interfaces are members of that zone.