Failover between two ISPs

[Chris5]

Hi Guys,

Apologies if this has been asked before - I'm new to the forum and to Fortinet. 

We currently have 2 individual networks connected to separate ISPs and we use a Fortigate 600c firewall in each network.

I need each network to be able to use the other link as a back up route to the internet should it's primary ISP connection fail.

I'd like to know the simplest configuration for this - My initial thought is to set up a second static route with a higher distance between the WAN 2 ports on each firewall? Traffic from each network needs to be isolated but still be able to access the internet when the primary ISP fails.

Any help/advice would be appreciated.

Thanks

[ykonstantakopoulos]

Hi Chris,

As you already suggested set up a second static route with a higher distance between the WAN 2 interfaces on each firewall.

Then make sure you have on both firewalls policies WAN2 -> WAN1. This way you isolate the networks.

And if I'm right (probably you won't need this) make sure you have policy routes in place! all traffic coming from WAN2 interface is routed to WAN1.

thanks,

yiannis

[Somashekara_Hanumant]

Hi,

Please refer the below Video link

http://video.fortinet.com/video/105/redundant-internet-connections-5-2

Hope this helps you to configure dual ISP.

Cheers

[vjoshi_FTNT]

Hello,

May I know if both the networks are geographically different and possibility of the physical connections between them?

Also, we need to keep in the mind about what if the interface stays UP, but the internet is down, gateway detect should help in this case.

Chris wrote:

Hi Guys,

Apologies if this has been asked before - I'm new to the forum and to Fortinet. 

We currently have 2 individual networks connected to separate ISPs and we use a Fortigate 600c firewall in each network.

I need each network to be able to use the other link as a back up route to the internet should it's primary ISP connection fail.

I'd like to know the simplest configuration for this - My initial thought is to set up a second static route with a higher distance between the WAN 2 ports on each firewall? Traffic from each network needs to be isolated but still be able to access the internet when the primary ISP fails.

Any help/advice would be appreciated.

Thanks

[Chris5]

Hi,

Thanks for your help guys - the plan is coming together.

Geographically we are in the same location and share a server room (& IT Team)- the firewalls are racked next to each other but are in different networks and connected to different ISPs (essentially we are 2 companies sharing office space - we are under the same umbrella company so sharing the ISPs for fail over is no issue). Each network uses a different IP addressing scheme (192.168.0.0 and 10.0.0.0) so I don't see an issue here.

I've seen you can set up a ping to determine that each link is active - after a few successive failures we want the connection to fail over.

[gschmitt]

The easiest way:

Connect the two FortiGates on the wan2 port

Go to System > Network > Interface

Assign FortiGate1 an IP Address on wan2 172.16.0.1/30

Assign FortiGate2 an IP Address on wan2 172.16.0.2/30

Go to Router > Static > Static Routes

On FortiGate1 create a new route

Destination 0.0.0.0/0.0.0.0

Device wan2

Gateway 172.16.0.2

Distance 11 (greater than your default route)

On FortiGate2 do the same but

Gateway 172.16.0.1

Create a new Static route on FortiGate1

Destination 10.0.0.0/8

device wan2

Gateway 172.16.0.2

Distance 10

On FortiGate2 do the same but

Destination 192.168.0.0/16

Gateway 172.16.0.2

Now go to Policy&Objects > Objects > Addresses

On FortiGate1 create an object for Network_fortigate2 with 192.168.0.0/16

On FortiGate2 create an object for network_fortigate1 with 10.0.0.0/8

Go to Policy&Objects > IPv4 > Policies

On FortiGate1 create new Policy

Incoming Interface: wan2

Source Address: network_fortigate2

Outgoing Interface: wan1

Destination Address: all

Enable NAT

configure rest as needed

On FortiGate2 do the same but

Source Address: network_fortigate1

Go to Router > Static > Settings

Create two new Link Health Monitor

Interface wan1/wan2

Gateway on wan2 Fortigate1: 172.16.0.2 / on fortigate2: 172.16.0.1

On wan1 Gateway from your ISPs

Enable health check

Ping

8.8.8.8 (or whatever you like)

The optimal way would be a HA setup with both devices, that way if one internet connection fails the other takes over AND if one of the FortiGates dies the other takes over

[ede_pfau]

When setting up the Link Health Monitor ALWAYS configure at least 2 independent ping target servers! If Google ever takes down 8.8.8.8 for maintenance both WAN lines will be killed...

And no, I would not choose ANY host on the internet just because it's IP address is easy to remember. Choose a host nearby, for instance one located with your ISP (DNS - might or might not allow pings).

You can set additional target IPs in the CLI (only).

[gschmitt]

ede_pfau wrote:

If Google ever takes down 8.8.8.8 for maintenance both WAN lines will be killed...

If Google ever takes down 8.8.8.8, even for a second, half of the worlds monitoring scripts and DNS queries would fail and the world would probably collapse. Or at least a few sysadmins ;)

Choose a host nearby, for instance one located with your ISP (DNS - might or might not allow pings).

Your ISPs gateway probably is the best choice (if you can ping it)

Telekom (as an example) took down a few "old" DNS servers and suddenly a customers internet connection failed ;)

[Chris5]

Hi Guys,

Thanks for all your help - The Failover is up and running!

I have one further question - Is there an alert or log I can set up so I can tell when the primary link has failed?

Just to be clear the firewalls are configured and pinging externally to check the link state - I've checked that it works by physically taking each cable out and ensuring connectivity from both networks. I'd simply like an email or log I can check to find out when the redundant link has been in use.

Any thoughts?

Thanks

[Allwyn_Mascarenhas]

Chris wrote:

Hi Guys,

Thanks for all your help - The Failover is up and running!

I have one further question - Is there an alert or log I can set up so I can tell when the primary link has failed?

Just to be clear the firewalls are configured and pinging externally to check the link state - I've checked that it works by physically taking each cable out and ensuring connectivity from both networks. I'd simply like an email or log I can check to find out when the redundant link has been in use.

Any thoughts?

Thanks

i've been thinking of this, can't think of any automatic feature in fortigate which can do this. I guess a batch file which keeps pinging the primary wan every 30mins or so as a scheduled task and raises a pop-up when the pings fail can do this work.

Do share if you get a way to do this.