High Availability & WAN Design Failover

[dur]

Hello,

I've a question regards WAN failover and HA A/P design that I can't find the answer anywhere in the documentation.

Please check the attached diagram designed, the question that comes in mind is:

[ul]

If the link WAN1 from CORE1 to Port1 on of FS-1 goes down, then the Internet connectivity will be done through CORE1 - WAN2 as far as I understand.

Is it possible to set it up, that instead of failover to use CORE1-WAN2 it uses CORE2-WAN1? The only way I've seen to set up this scenario is to enable port-monitoring on CORE1-WAN1 and then failover to CORE2. But in my opinion it seems a bit of extreme use to failover to CORE2 just only because the link between CORE1 WAN1 / FS1 Port1 fails.[/ul]

Thanks for your help.

[Toshi_Esumi · Accepted solution]

With FortiGate HA a-p mode, both unit has basically the same config (copied over from a to p). So if you set up a fail-over from wan1 to wan2 on the current active, the standby unit has the same config and duplicate the fail-over operation if a-p roles are flipped. 

How let the standby unit take over the control from the active unit is a completely separate issue and you can control it by monitoring interfaces.

By assuming wan1-ISP1 and wan2-ISP2 are pairs, I would set up a fail-over mechanism wan1->wan2 with some optional split traffic first, then set up HA a-p between two 200Es. Much more complicated fail-overs are probably possible, but it wouldn't fit with HA a-p and more importantly wouldn't add much benefits in my opinion, other than more complicated troubleshooting/isolation process when a fail-over situation happens.

[dur]

Thanks for the answer Toshi, very much appreciated! :)