I have a VIP setup with a static route, so it can be advertised into bgp. The link-monitor checks the server the VIP is mapped to. When I shutdown the server, the link-monitor shows the status is dead, but the static route is not withdrawn from the routing table. Is blackhole as a next hop not supported for link-monitor?
FortiOS 7.0.15
config firewall vip
edit "VIP"
set uuid 6b05a182-a52a-51ef-84f5-d38866bd0382
set extip 77.77.77.77
set mappedip "172.16.78.10"
set extintf "WAN"
set portforward enable
set extport 80
set mappedport 80
next
end
FortiGate-VM64-KVM # show router static
config router static
edit 1
set dst 77.77.77.77 255.255.255.255
set blackhole enable
next
end
config router bgp
set as 65017
config neighbor
edit "10.17.255.1"
set remote-as 65000
next
end
config network
edit 3
set prefix 77.77.77.77 255.255.255.255
next
end
FortiGate-VM64-KVM # get router info routing-table static
Routing table for VRF=0
S 77.77.77.77/32 [10/0] is a summary, Null, [1/0] <<< static not removed
FortiGate-VM64-KVM # show system link-monitor
config system link-monitor
edit "BGP-VIP"
set srcintf "DCI_LAN"
set server "172.16.78.10"
set route "77.77.77.77/32"
next
end
FortiGate-VM64-KVM #
FortiGate-VM64-KVM # diagnose sys link-monitor status
Link Monitor: BGP-VIP, Status: dead, Server num(1), HA state: local(alive), shared(dead)
Flags=0x9 init log_downgateway, Create time: Fri Nov 29 13:34:35 2024
Source interface: DCI_LAN (12)
Monitor subnet(1): 77.77.77.77/32
Interval: 500 ms
Service-detect: disable
Diffservcode: 000000
Class-ID: 0
Peer: 172.16.78.10(172.16.78.10)
Source IP(172.16.78.2)
Route: 172.16.78.2->172.16.78.10/32, gwy(172.16.78.2)
protocol: ping, state: dead
Packet lost: 100.000%
Number of out-of-sequence packets: 0
Recovery times(0/5) Fail Times(4/5)
Packet sent: 155, received: 0, Sequence(sent/rcvd/exp): 156/0/0
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Link-monitor can remove static routes only toward the interface you're monitoring. In your case, "DCI_LAN". Your static route is a blackhole route and not toward DCI_LAN.
Toshi
check the kernel route too
get router info kernel >> if that is being removed or not
the route is present still in the kernel, as @Toshi_Esumi confirmed my suspicions as well. I will need to do some sort of BGP conditional advertisement.
Created on 12-02-2024 08:43 AM Edited on 12-02-2024 08:44 AM
Why do you need to "hide" the VIP outside IP from advertisement? VIP would never go away. That's the VIP behavior. The source of this access just needs to realize the VIP destination is down by like link-monitor/IP SLA, or equivalent, it needed to be detected automatically.
Toshi
It seems like the blackhole next hop might not be supported for link-monitor, as it usually doesn't trigger a route withdrawal when the monitored server goes down Sad Shayari in Hindi. You might want to check if the routing protocol has specific configurations for handling link-monitor with static routes, or if any adjustments can be made to support dynamic withdrawals in this setup.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1710 | |
1093 | |
752 | |
446 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.