How to automatic disable static route in ipsec tunnel when tunnel goes down

[Reshans]

In our FortiGate environment, both BGP and static routes are configured for the same destination. However, the system currently prefers the static route, which remains active at all times. As a result, during an IPsec tunnel failure, traffic does not automatically fail over to the BGP route. At present, we are required to manually disable the static route on both ends to allow BGP to take over. We are seeking a solution that enables automatic failover from the static route to the BGP route when the IPsec tunnel goes down.

Ipsec tunnel not showing in interfaces

[funkylicious]

why not just delete the static route, which will take precedence always?

other options would be to either do a automation stitch to delete/disable the static route when a event for the ipsec is down or https://community.fortinet.com/t5/FortiGate/Technical-Tip-Link-Monitor-Explained/ta-p/197504 

[Toshi_Esumi]

With FGTs, even if you put the same admin distance on the static route with BGP, like 20 for eBGP/200 for iBGP, it doesn't place both routes as parallel routes in the routing table. Instead, the newly introduced route wins.

You didn't explain the whole topology including both paths. But eventually the best option is to set up BGP through the primary IPsec path as well so that you can set local-preference to prefer primary IPsec path at the BGP level.

Otherwise you have to use link-monitor as @funkylicious suggests. It's quite ugly to have both static routing path and BGP routing path for the same destination when the static side is the primary. 

Toshi 

[Reshans]

This is my topology and so Tunnel 3 for used sttaic route tunnel 3 separate tunnel in for NAS server access i need when tunnel 3 goes down need to automatic disable this sttaic routes

[Toshi_Esumi]

It doesn't show the topology of the BGP domain. Which ones are BGP neighbors?

Toshi 

[Toshi_Esumi]

Or, if all routing devices are FGTs, there is no reason you can't set up BGP neighboring through all paths to have same parallel routes in a local FGT's routing table. Then use SD-WAN rules to set path preference per type of traffic if you want to. BGP itself can do only fail-over for all types of traffic.

Toshi