Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Not applicable

PBR & Failover

Hii. I' m new to fortigate. my question is, is there any failover to be use together with PBR ? Someway sounds like this in Cisco : route-map <name> permit <seq> match ip address <acl> set interface <wan1_if> <wan2_if> the wan1 take the precedence over wan2. so when wan1_if get down, the wan2_if will take the roles. In Watchguard, the configuration stands inside the policy. just checked and done. It should be easy thing. >,< I didn' t find it in CLI Reference Guide. thanks. Regards, Cu Ian Wijaya
6 REPLIES 6
Not applicable

Hello. Anybody here ?
ede_pfau
SuperUser
SuperUser

Hello, and welcome to the Forums! Bear with us, your question is not an everyday scenario. The easiest way to find out is to make a test. I assume you have 2 wan lines running. Configure a policy route via wan1 and test it. Check the routing monitor - it should not be visible here. Now if you drop the wan1 line will the traffic stop? My guess is Yes as this is a policy. Policies do not exist depending on a link status like routes do. If you use a route via wan1 and wan1 fails then this route will be deleted from the routing table. PBR completely circumvents the routing table though.
Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Not applicable

Thx for your reply edde. I have resolved that yesterday. It can be done by apply-ing policy route that direct dmz1 to wan 1 and internal1 to wan 2 without entering any ip address on gateway address. Then u must add static route to both gateway with equal distance. (+ configuring ping server) so if the one of them goes down, the policy route (that has empty gateway address) will not check and it will jump to default static route. the test run successfully until I test the VIP. the VIP can' t be accessed from outside network. I am still searching for the reason. any suggestion ?
ede_pfau
SuperUser
SuperUser

Nope, not today I' m afraid. Post some more information about how you defined the VIP, on which interface, and maybe someone else can jump in.
Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Not applicable

internal1 all -> 0.0.0.0/0.0.0.0 -> wan1 <no ip> dmz1 all -> 0.0.0.0/0.0.0.0 -> wan2 <no ip> then i added static routes for wan1 and wan2 with equal distance 0.0.0.0/0.0.0.0 <gw ip for wan1> 0.0.0.0/0.0.0.0 <gw ip for wan2> then I add dead gw detection in interface setting. any other thing that u need to know ?
Not applicable

Hi Eddie / Ian, I am a newbie to Fortigate. Running through pretty much a similar situation, I have a LAN and 2 WAN IP (Two different service provider). By enabling " Detect Interface Status for Gateway Load Balancing" then assiging the WAN_2 modem IP with spillover threshold . We can acheive load balancing. My requirement is , Failover: I want my LAN to use WAN_1 always. In case of failure , it shd switch to WAN_2 then back to WAN_1 when it is back up and running. I could see Eddie had done it , but i do not get a clear picture of how this was acheived. I would really appreciate if any one of you could clearly explain this for me!!!
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors