Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
bluephoenix71
New Contributor

Fortigate 100D (Standalone) Secondary WAN link not failing over

Hi all,

 

I have 1 firewall on site but with 2 different internet connections to 2 different ISP's.

 

Basic configuration for static route having backup link with higher priority (5) and primary (1).

 

My question is that if the physical connection to the internet provider is up but their service is down (route-lost within ISP network), how can I configure the firewall to fail-over to the secondary?  It seems the only work-around I can do is ask local support to physically remove the primary so that the secondary could fail-over.

 

Please let me know if you need further information.

 

 

Thanks,

4 REPLIES 4
ashukla_FTNT
Staff
Staff
bluephoenix71

Can you further explain about the ping server?  The firewall is accessible via internet and not on a WAN, do we ask the provider to provide an IP address that we can ping?  Will 8.8.8.8 suffice?

 

I just looked at the firewall and the model is 100D, and the dead gateway feature is not present.  Using 5.0 as firmware.

 

*** NEVERMIND, FOUND THE DEAD GATEWAY ECMP FEATURE UNDER System > Router > Static Route > Setting > Create New

 

ashukla wrote:

Use Dead Gateway Detection:

 

http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30626

ede_pfau
SuperUser
SuperUser

If you already use v5.2.2 then create a Virtual WAN link with wan1, wan2. All Dead Gateway Detection settings in one place, targets can be pinged or HTTP-getted and more.

 

+

if you want the second link to only become active after failover then you  would set the distance higher than on the primary link, not the priority. If you set the distances equal and equal priorities then you have load balancing over both links at the same time. If the prios differ, you've got a backup link.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
bluephoenix71

It is configured that way

EXTERNAL = member port is wan1

EXTERNAL 2 = member port wan2

 

EXTERNAL Static route has priority 1

EXTERNAL 2 Static route has priority 5

 

I am asking if the provider link is not hard down, but their internet service is **** (re-route or next hop down within the provider).  How can I configure the firewall to automatically failover?

 

I am using a Fortigate 100D and v5.0 and the Dead Gateway Detection is not present on System > Network Interfaces...

 

*** NEVERMIND, FOUND THE DEAD GATEWAY ECMP FEATURE UNDER System > Router > Static Route > Setting > Create New

 

ede_pfau wrote:

If you already use v5.2.2 then create a Virtual WAN link with wan1, wan2. All Dead Gateway Detection settings in one place, targets can be pinged or HTTP-getted and more.

 

+

if you want the second link to only become active after failover then you  would set the distance higher than on the primary link, not the priority. If you set the distances equal and equal priorities then you have load balancing over both links at the same time. If the prios differ, you've got a backup link.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors