Interdependence b/w Link Monitor and interface's "fail-detect"

[AlexFerenX]

Hi!

consider:

config system link-monitor
edit monitor_id

srcintf ifname

server monitored_server

:

update-cascade-interface disable

update-policy-route disable

update-static-route disable

end

as I understand, this will cause interface ifname to be marked as failed if monitoring of monitored_server fails. This means all configured dependencies, including all static and dynamic routes, would become unavailable. Please correct me if wrong.

I do not understand if the following is necessary and what effect/value it adds to above:

config system interface

edit ifname

:

fail-detect enable
fail-detect-option link-down detectserver

end

Any one can answer?

Thanks!

[Toshi_Esumi]

You meant like this, right?
FortiGate-60F (vogus_server_monitor) # show
config system link-monitor
  edit "vogus_server_monitor"
    set srcintf "wan1"
    set server "100.64.0.1"
    set update-cascade-interface disable
    set update-static-route disable
    set update-policy-route disable
  next
end

The destination doesn't exist in my network and not pingable.

FortiGate-60F # exe ping 100.64.0.1
PING 100.64.0.1 (100.64.0.1): 56 data bytes

--- 100.64.0.1 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss

As the result, the link-monitor status is "dead".

FortiGate-60F # diag sys link-monitor status

Link Monitor: vogus_server_monitor, Status: dead, Server num(1), cfg_version=0 HA state: local(dead), shared(dead)
Flags=0x1 init, Create time: Wed May 7 16:20:09 2025
Source interface: wan1 (5)
VRF: 0
Interval: 500 ms
Service-detect: disable
Diffservcode: 000000
Class-ID: 0
Transport-Group: 0
Class-ID: 0
  Peer: 100.64.0.1(100.64.0.1)
    Source IP(75.145.19.83)
    Route: 75.145.19.83->100.64.0.1/32, gwy(75.145.19.86)
    protocol: ping, state: dead
        Packet lost: 100.000%
        MOS: 4.350
        Number of out-of-sequence packets: 0
        Recovery times(0/5) Fail Times(2/5)
        Packet sent: 103, received: 0, Sequence(sent/rcvd/exp): 104/0/0

However, all routes are still there and I didn't lose anything including IPsec vpn over wan1("la-tos1" below).

FortiGate-60F # get router info routing-t all
---[snip]---

Routing table for VRF=0
S* 0.0.0.0/0 [10/0] via x.x.x.x, wan1, [1/0]
                   [10/0] via x.x.x.x, wan2, [10/0]
B 1.2.1.2/32 [20/0] via 10.242.0.1 (recursive via la-tos1 tunnel x.x.x.x), 08:49:47, [ 1/0]
B 10.10.110.1/32 [20/0] via 10.242.0.1 (recursive via la-tos1 tunnel x.x.x.x), 08:49:4 7, [1/0]
B 10.100.100.1/32 [20/0] via 10.242.0.1 (recursive via la-tos1 tunnel x.x.x.x), 08:49: 47, [1/0]

.......

The bottom line is the link-monitor doesn't disable interfaces.
And, the "fail-detection" on an interface is, I believe, only for aggregate interface or redundant interface. Nothing to do with link-monitor.
https://docs.fortinet.com/document/fortigate/7.4.7/administration-guide/321562/failure-detection-for...
https://docs.fortinet.com/document/fortigate/7.4.7/administration-guide/567758/aggregation-and-redun...

Toshi

[AlexFerenX]

Hi Toshi!

> The bottom line is the link-monitor doesn't disable interfaces.

Thank you. So, "system link-monitor" only defines the monitoring test, and affects

1. static route matching system link-monitor's "srcintf" interface if system link-monitor's "update-static-route" is 'enable'; or,

2. PBR matching system link-monitor's "srcintf" interface if system link-monitor's "update-policy-route" is 'enable'; or,

3a. interface matching system link-monitor's "srcintf" interface if that interface's "fail-detect" set to 'enable' AND "fail-detect-option" is set to 'detectserver; and,

3b. as 3a, but also interface specified by "fail-alert-interfaces" if system link-monitor's "update-cascade-interface" is 'enable'

?

> And, the "fail-detection" on an interface is, I believe, only for aggregate interface or redundant interface. Nothing to do with link-monitor

See Bring other interfaces down when link mon... - Fortinet Community - in this a slightly different case - there's cascaded interface, port3 (specified by ill-named "fail-alert-interfaces"), but if we do not provision "update-cascade-interface enable" then won't only wan1 will be marked as down?

config system link-monitor
edit monitor_id

srcintf wan1

server 1.1.1.1

:

update-cascade-interface disable

update-policy-route disable

update-static-route disable

end

config system interface
edit wan1
set fail-detect enable
set fail-detect-option detectserver link-down
end

Thanks!

[Toshi_Esumi]

I didn't know about existence of the KB you referred to. This means my understanding was not correct and I need to test the conbination of these features again. Meanwhile wait for somebody else who know about these to chime in.

Toshi

[RhondaTorres]

Hi everyone, I'm curious about the relationship between link monitors and interface fail-detect. If a link monitor flags an interface due to a failed server, does that inherently cover the "fail-detect" function on the interface itself? It feels a bit redundant. Perhaps like playing Snow Rider 3D where multiple paths lead to the same finish line.