Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
gilfalko
New Contributor III

Routing specific DSCP tagged packets

Hi

 

My situation is like this:

I have 3 WAN connections and a remote site with a single WAN connection.

I'd like to monitor the latency to the remote site using all 3 WAN links and from a single address (our Opsview server).

I know I can tag the outgoing packets using DSCP. 

My question is now, can I use 3 different tags in order to tell the Fortigate unit to route each through a different WAN connection?

 

Thanks

Gil

6 REPLIES 6
emnoc
Esteemed Contributor III

Don't know of any firewall that routes via DSCP tags.  Don't even think that's an option in a router AFAIK

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
gilfalko
New Contributor III

I actually think it does exist...

 

There's a TOS pattern for making PBRs.

Everything with the default of 0 gets picked up usualy.

If I change it I might get what I want...

 

ede_pfau

I don't think you'd even need to set the DSCP flag. Just use PBR with the source address as criterion (/32), in combination with the destination target address.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
gilfalko
New Contributor III

If I want to monitor the same address from 3 wan connections,

a regular pbr will always send me through a single connection.

 

emnoc
Esteemed Contributor III

There's a TOS pattern for making PBRs.

 

That's for setting TOS bits and not for making routing decisions based on TOS.

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
ede_pfau

@gilfalko: [strike]Really? Why? IMHO the whole sense of PBR is to divert traffic to destinations or interfaces based on criteria other than the destination address: source address, TOS flag, among others.[/strike]

[strike]So why would 3 PBRs not work, looking at 3 different source addresses, sending traffic out 3 different interfaces? BTW, taking the src adress or the TOS flag state for deciding should make no difference, but the TOS thing is one additional step.[/strike]

Sorry, I've overlooked that you wanted to ping ONE target from ONE source host. Of course then the TOS flag will be the only differentiator left, assuming you do the tagging on the source host.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors