Is it possible to configure VRRP in fortigate using GUI?

[BusinessUser]

My current firewall seems to be able to support using CLI 

but I want to do using GUI.

[BusinessUser]

Link monitoring remove static routes.

Vrdst check for static routes?

[Toshi_Esumi]

As the KB is describing, it checks kernel table. All static routes go in there. When the link/interface (set device) specified in the static route goes done all those static routes would be removed. However, if you have a backup path (default route with a high admin distance or priority) to a secondary ISP via a different interface it wouldn't trigger VRRP failover. That's why VRRP/VRDST config has an option:
   set ignore-default-route enable

Toshi

[BusinessUser]

Hi I understand. But you can specify the interface in the static route isnt it?

Where do I raise a feature request for vrrp as gui in the partner portal?

[Toshi_Esumi]

What I would do in your topology (based on my guess since you never explained the entire picture) is below:

static route:

  8.8.8.8/32 -> wan

  0/0->wan

link-monitor:

 server IP = 8.8.8.8

 set update-static-route enable (default)

VRDST:

  set vrdst 8.8.8.8

  set ignore-default-route enable

Above is NOT the entire config but you're already familiar with those CLI configs you need. When "wan" link goes down, both static routes will be removed from routing-table. If the link doesn't go down but something is wrong inside of ISP causing no-internet, those routes would stay there. That's when the link-monitor kicks in to remove 8.8.8.8/32 route. Since it would ignore default route, it doesn't put 0/0 route in consideration as a proper matching route for 8.8.8.8. So VRRP failover will be triggered.

Let us know if still doesn't work. At that time, you need to share us the config under those three components, as well out output of diag command "get router info vrrp".

Toshi

[benshank3]

VRRP on the switches doesn't make sense to me. You should be running VRRP on the SDWAN-routers that the switches use as their default gateway, or am I misunderstanding something? Please draw a diagram of the network topology, text with arrows between devices doesn't really cut it here.

[BusinessUser]

ASN123 -- link 1 --> R1 with ASN 65000

ASN123 -- link 2 --> R2 with ASN 65000

R1 and R2 have lan interface that are connected together with switch.