Link-monitor VIP static route not working

[massive627]

I have a VIP setup with a static route, so it can be advertised into bgp.  The link-monitor checks the server the VIP is mapped to.  When I shutdown the server, the link-monitor shows the status is dead, but the static route is not withdrawn from the routing table.  Is blackhole as a next hop not supported for link-monitor?

FortiOS 7.0.15

config firewall vip
edit "VIP"
set uuid 6b05a182-a52a-51ef-84f5-d38866bd0382
set extip 77.77.77.77
set mappedip "172.16.78.10"
set extintf "WAN"
set portforward enable
set extport 80
set mappedport 80
next
end

FortiGate-VM64-KVM # show router static
config router static
edit 1
set dst 77.77.77.77 255.255.255.255
set blackhole enable
next
end

config router bgp
set as 65017
config neighbor
edit "10.17.255.1"
set remote-as 65000
next
end
config network
edit 3
set prefix 77.77.77.77 255.255.255.255
next
end

FortiGate-VM64-KVM # get router info routing-table static
Routing table for VRF=0
S 77.77.77.77/32 [10/0] is a summary, Null, [1/0] <<< static not removed

FortiGate-VM64-KVM # show system link-monitor
config system link-monitor
edit "BGP-VIP"
set srcintf "DCI_LAN"
set server "172.16.78.10"
set route "77.77.77.77/32"
next
end

FortiGate-VM64-KVM #
FortiGate-VM64-KVM # diagnose sys link-monitor status

Link Monitor: BGP-VIP, Status: dead, Server num(1), HA state: local(alive), shared(dead)
Flags=0x9 init log_downgateway, Create time: Fri Nov 29 13:34:35 2024
Source interface: DCI_LAN (12)
Monitor subnet(1): 77.77.77.77/32
Interval: 500 ms
Service-detect: disable
Diffservcode: 000000
Class-ID: 0
Peer: 172.16.78.10(172.16.78.10)
Source IP(172.16.78.2)
Route: 172.16.78.2->172.16.78.10/32, gwy(172.16.78.2)
protocol: ping, state: dead
Packet lost: 100.000%
Number of out-of-sequence packets: 0
Recovery times(0/5) Fail Times(4/5)
Packet sent: 155, received: 0, Sequence(sent/rcvd/exp): 156/0/0

[Toshi_Esumi]

Link-monitor can remove static routes only toward the interface you're monitoring. In your case, "DCI_LAN". Your static route is a blackhole route and not toward DCI_LAN.

Toshi

[sjoshi]

check the kernel route too

get router info kernel >> if that is being removed or not

[massive627]

the route is present still in the kernel, as @Toshi_Esumi confirmed my suspicions as well.  I will need to do some sort of BGP conditional advertisement. 

[Toshi_Esumi]

Why do you need to "hide" the VIP outside IP from advertisement? VIP would never go away. That's the VIP behavior. The source of this access just needs to realize the VIP destination is down by like link-monitor/IP SLA, or equivalent, it needed to be detected automatically.

Toshi

[ferunjack72]

It seems like the blackhole next hop might not be supported for link-monitor, as it usually doesn't trigger a route withdrawal when the monitored server goes down Sad Shayari in Hindi. You might want to check if the routing protocol has specific configurations for handling link-monitor with static routes, or if any adjustments can be made to support dynamic withdrawals in this setup.