Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Nolzee
New Contributor

Local Breakout / Policy routes

Current set up: Multiple sites with firewalls all part of MLPS with a central breakout for internet via data center firewalls

Goal: To have local breakout for internet at each site

 

My understanding would be, we would have another VLAN under the WAN interface on our remote site firewall which would then have say a /30 for routing out to the internet this would be configured with policy routes so www. traffic from interface X goes to internet.

 

 

Question: As these are policy routes say if the interface goes down they won't then have a failover because they are not dynamic and would require manual interference. 

 

Is there a better way to configure local breakouts which is dynamic ? 

1 REPLY 1
pkavin
Staff
Staff

Hello Nolzee,

 

The simple and more better way to design/configure your FortiGate is to use SD-WAN as you can have some additional benefits of failover, link-monitor and traffic load balancing.

 

But, I can understand that SD-WAN needs a whole re-configuration of FortiGate and if you want to use policy routes then you can do so as well.

 

In FortiOS 7.0.1, policy-routes can detect the health-monitor of the interface it is sending traffic to and depending on that the policy route could failover. 

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/81096/enable-or-disable-updating-pol...

 

So, yes policy routes are not dynamic in earlier versions, but if your FortiGate is capable of running FortiOS 7.0.1 and later, then you can use the above feature and failover without any manual intervention.

 

Hopefully, this helps.

 

Kavin
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors