PBR & Failover

[#1]

Hii. I' m new to fortigate. my question is, is there any failover to be use together with PBR ? Someway sounds like this in Cisco : route-map <name> permit <seq> match ip address <acl> set interface <wan1_if> <wan2_if> the wan1 take the precedence over wan2. so when wan1_if get down, the wan2_if will take the roles. In Watchguard, the configuration stands inside the policy. just checked and done. It should be easy thing. >,< I didn' t find it in CLI Reference Guide. thanks. Regards, Cu Ian Wijaya

[#2]

Hello. Anybody here ?

[ede_pfau]

Hello, and welcome to the Forums! Bear with us, your question is not an everyday scenario. The easiest way to find out is to make a test. I assume you have 2 wan lines running. Configure a policy route via wan1 and test it. Check the routing monitor - it should not be visible here. Now if you drop the wan1 line will the traffic stop? My guess is Yes as this is a policy. Policies do not exist depending on a link status like routes do. If you use a route via wan1 and wan1 fails then this route will be deleted from the routing table. PBR completely circumvents the routing table though.

[#4]

Thx for your reply edde. I have resolved that yesterday. It can be done by apply-ing policy route that direct dmz1 to wan 1 and internal1 to wan 2 without entering any ip address on gateway address. Then u must add static route to both gateway with equal distance. (+ configuring ping server) so if the one of them goes down, the policy route (that has empty gateway address) will not check and it will jump to default static route. the test run successfully until I test the VIP. the VIP can' t be accessed from outside network. I am still searching for the reason. any suggestion ?

[ede_pfau]

Nope, not today I' m afraid. Post some more information about how you defined the VIP, on which interface, and maybe someone else can jump in.

[#6]

internal1 all -> 0.0.0.0/0.0.0.0 -> wan1 <no ip> dmz1 all -> 0.0.0.0/0.0.0.0 -> wan2 <no ip> then i added static routes for wan1 and wan2 with equal distance 0.0.0.0/0.0.0.0 <gw ip for wan1> 0.0.0.0/0.0.0.0 <gw ip for wan2> then I add dead gw detection in interface setting. any other thing that u need to know ?

[#7]

Hi Eddie / Ian, I am a newbie to Fortigate. Running through pretty much a similar situation, I have a LAN and 2 WAN IP (Two different service provider). By enabling " Detect Interface Status for Gateway Load Balancing" then assiging the WAN_2 modem IP with spillover threshold . We can acheive load balancing. My requirement is , Failover: I want my LAN to use WAN_1 always. In case of failure , it shd switch to WAN_2 then back to WAN_1 when it is back up and running. I could see Eddie had done it , but i do not get a clear picture of how this was acheived. I would really appreciate if any one of you could clearly explain this for me!!!