Next Hop Monitoring

[MVIOX]

I have a client that has a rather interesting case involving network connectivity issues. The ISP stated that there is no problem, yet time and time again the WAN port keeps flapping. Does Fortinet have a way to monitor the next Hop from the WAN side to determine Network ISP stability? Or could you recommend an alternative appliance?

[Dave_Hall]

Flapping on the WAN port connection usually means a possible duplex/speed mismatch. You can check for that from the CLI by typing diag hardware deviceinfo nic <interface name> and check for any errors. Dead gateway detection can be configured from Router (or routing) section. (Sorry, not in front of a fgt device for exact path -- perhaps someone can give the path).

[Istvan_Takacs_FTNT]

# show full-configuration router gwdetect config router gwdetect edit " port1" set failtime 5 set ha-priority 1 set interval 5 set protocol ping set server " 8.8.8.8" set source-ip 0.0.0.0 next edit " port2" set failtime 5 set ha-priority 1 set interval 5 set protocol ping set server " 9.9.9.9" set source-ip 0.0.0.0 next end

[Istvan_Takacs_FTNT]

# show sys interface port1 config system interface edit " port1" set vdom " root" set ip 2.2.2.1 255.255.255.0 set allowaccess ping https ssh fgfm set fail-detect enable set fail-detect-option detectserver set type physical set spillover-threshold 1 set alias " external1" set macaddr 00:0c:29:00:7c:76 next end firewall (root) # show sys interface port2 config system interface edit " port2" set vdom " root" set ip 3.3.3.1 255.255.255.0 set allowaccess https ssh fgfm set fail-detect enable set fail-detect-option detectserver set type physical set alias " external2" set macaddr 00:0c:29:00:7c:80 next end You can also configure SNMP monitoring and when the interface goes down/up it would send a trap. Best way to keep an eye on the flapping interface (if it' s really flapping) Also if your customer has dynamic routing configured to their ISP, the route would drop when the interface goes down. The route age can tell you when it was dropped last time. You can also configure logging of changes to neighbor status. If there' s a router further up to the provider, these tools above could also be used to detect any link issues.

[MVIOX]

Thank you so much! You 2 have really set a standard for support! I was afraid I was going to have to go to a secondary appliance. And yea it is a static ip so it makes it that much easier to detect.

[MVIOX]

Sorry call me ignorant, " port1" " port2" would that be referring to WAN1 WAN2?

[Istvan_Takacs_FTNT]

You are free to use any of your ports.

[lightmoon1992]

If it is a logical failure detected by DGD, you should see log stating that gateway configured is not detected. if so, your ISP may be blocking sensing protocol " like ICMP" toward some widely recognized IPs (8.8.8.8, 8.8.4.4, etc) Mohammad