Separate Policies for 3G Failover

[jlozen]

I' m currently looking into setting up 3G failover on some devices and am at a bit of a crossroads regarding policy enforcement. I see how to set the connection up and all that jazz, but I' m curious about how the policies take effect when the failover kicks in. The modem is its own interface but when it takes over for the WAN connection does it essentially become the WAN link? Do all the WAN policies/rules apply? Or do I need to duplicate the policies/rules on the WAN interface to also be on the MODEM interface if I want them to be in effect when the 3G failover is being used?

[Mark_Oakton]

Hi Depends on what you want to use it for, if you want to split traffic and send some over the 3g, then have a separate policy with destination interface the 3g what are you trying to use the 3g interface for? Mark

[jlozen]

The idea is that it' ll fail over to the 3g connection if the main wan connection goes down.

[ede_pfau]

Sorry to kick in...I' m about to configure this same setup for a customer too. When the modem is activated, only policies with ' modem' in source or destination interface are effective. That is, if you only have policies for ' wan1' traffic will stop. You can of course duplicate all policies for the ' modem' interface. Which is tedious and error prone, and a pain later to keep in sync. For this, FortiOS has the ' zone' object. It' s a container for interfaces and can be used whereever you can use an interface. All policies are only created once, from/to zone to/from other interface (I think you get the idea). Somebody very slick once mentioned on this forum that sessions do not have to be renegotiated in case of failover if they go through a zone, even if member interfaces fail. That makes sense. If you want to go that way you need to prepare your config a bit. You can only associate an interface with a zone if there are no references to that interface, like policies, DHCP servers, routes etc. For an existing config it would be effective to create the zone (with a dummy interface member if needs be), backup the config, and edit it in an editor offline. Just replace all interface names of the interface used (e.g. ' wan1' ) with the zone name. Then make the interface a zone member and restore that config file. Sounds more troublesome than it actually is. In your case I would check the ' block intra-zone traffic' option while creating the zone. Rememer to set up 2 default routes, the backup route pointing to ' modem' having a larger distance. Plus dead gateway detection (monitoring an external server via ping). This way, only one default route will show up in the Routing Table. When ' wan1' goes down, it' s route will disappear and the backup route will be established. And test, test, test...for instance, what happens when ' wan1' goes up again? In FortiOS 5.2.1 there is a new wizard for a Virtual WAN Link which effectively does all that: a zone, routes, dead gateway detection via health monitoring. Sort of a shortcut.