Please help verify priority

[a11smiles]

Using FortiGate 80F with Fortinet OS 7.4.0.

I am configuring dual WAN. I want my primary (WAN1) to be used whenever the health link is alive. My secondary (WAN2) should only be used while WAN1 is down (dead). As soon as WAN1 comes back alive, I want my traffic to be rerouted immediately through WAN1.

Again, I always want to use WAN1 when its health is alive.

Here is my configuration. Can someone verify it and let me know if something needs to be changed?

config system link-monitor
    edit "wan1 failover"
        set addr-mode ipv4
        set srcintf "wan1"
        set server-config default
        set server-type static
        set server "8.8.8.8"
        set protocol ping
        set gateway-ip 0.0.0.0
        set source-ip 0.0.0.0
        set interval 3000
        set probe-timeout 500
        set failtime 3
        set recoverytime 3
        set probe-count 30
        set ha-priority 1
        set update-cascade-interface enable
        set update-static-route enable
        set update-policy-route enable
        set status enable
        set diffservcode 000000
        unset class-id
        set service-detection disable
    next
    edit "wan2 failover"
        set addr-mode ipv4
        set srcintf "wan2"
        set server-config default
        set server-type static
        set server "8.8.8.8"
        set protocol ping
        set gateway-ip 0.0.0.0
        set source-ip 0.0.0.0
        set interval 3000
        set probe-timeout 500
        set failtime 3
        set recoverytime 3
        set probe-count 30
        set ha-priority 1
        set update-cascade-interface enable
        set update-static-route enable
        set update-policy-route enable
        set status enable
        set diffservcode 000000
        unset class-id
        set service-detection disable
    next
end

Thanks!

[Toshi_Esumi · Accepted solution]

You don't need the second part if wan1 is primary. As long as wan1 side is up, nothing needs to be done when wan2 goes down.
Just make sure you have below set.

config system global
  set snat-route-change enable  (by default it's disabled)
end

Toshi

[Toshi_Esumi · Accepted solution]

You don't need the second part if wan1 is primary. As long as wan1 side is up, nothing needs to be done when wan2 goes down.
Just make sure you have below set.

config system global
  set snat-route-change enable  (by default it's disabled)
end

Toshi

[a11smiles]

Thanks, one other question...

Do I need to configure static routes as the documentation says:
(As you can see wan1 has a priority of 1, and wan2 has a priority of 2.)

config router static
    edit 1
        set device "wan1"
        set dynamic-gateway enable
    next
    edit 2
        set priority 2
        set device "wan2"
        set dynamic-gateway enable
    next
end

[Toshi_Esumi · Accepted solution]

Don't have to be static default routes. But you have to make wan1 default route win over the wan2's. If they're dhcp or pppoe, you need to set a higher distance on wan2 interface. The priority works only with static routes.
If you want to use static default routes instead, you need to "set defaultgw disable" on the interfaces.

In any case I would recommend you test it for multiple failure scenarios. Once it's set up.

Toshi

[a11smiles]

Ahhh. That's what I was missing as my routing table was showing both as the candidate default (they were still set to the default of 5). 

I've set wan1 to 10 and wan2 to 20. Now it only shows wan1 in the routing table (as the default) even though both are alive.

Thanks again. I sincerely appreciate your help.