Spillover config

[#1]

I have problem setting spillover on the firewall. I' ve enabled ECMP route fail over on the firewall. I' ve written policies for 2 wan interfaces. Made static routes with the same distance for all destinations.Set spillover threshold, But..... The fortinet admin guide said that traffic goes through the 1st interface before it reaches the threshold. But I have traffic going through both interfaces and load balances!!!!why this happens?

[romanr]

You need to set a higher priority value to your 2nd interface route. Until 4.1 you need to do this via CLI, since 4.2 you can do this via the web interface! best regards, Roman

[#3]

Thanks for your reply But....I' ve done this before, I' ve changed the distance, I' ve changed the priority...none of them helped me. When I do this, just one interface crosses the traffic , even when it passes the threshold, the traffic does not transmit over the other interface.

[Fullmoon]

Did you used this command " diagnose netlink dstmac list" to check whether the said interface exceeds? Did you prefer this example from Admin guide? For example, consider a FortiGate unit with interfaces port3 and port4 both connected tothe Internet through different ISPs. ECMP routing is set to usage-based and route spillover for to 100 KBps for port3 and 200 KBps for port4. Two ECMP default routes are added, one for port3 and one for port4. If the route to port3 is higher in the routing table than the route to port4, the FortiGate unit sends all default route sessions out port3 until port3 is processing 10Mbps of data. When port3 reaches its configured bandwidth limit, the FortiGate unit sends all default route sessions out port4. When the bandwidth usage of port3 falls below 10Mbps, the FortiGate again sends all default route sessions out port3. New sessions to designating IP addresses that are already in the routing cache; however, use the cached routes. This means that even of port3 is exceeding its bandwidth limit, new sessions can continue to be sent out port3 if their destination addresses are already in the routing cache. As a result, new sessions are sent out port4 only if port3 exceeds its bandwidth limit and if the routing cache does not contain a route for the destination IP address of the new session. Also, the switch over to port4 does not occur as soon as port3 exceeds its bandwidth limit. Bandwidth usage has to exceed the limit for a period of time before the switch over takes place. If port3 bandwidth usage drops below the bandwidth limit during this time period, sessions are not switched over to port4. This delay reduces route flapping. If you are configuring usage-based ECMP in most cases you should add spillover thresholds to all of the interfaces with ECMP routes. The default spillover threshold is 0 which means no bandwidth limiting. If any interface has a spillover threshold of 0, no sessions will be routed to interfaces lower in the list unless the interface goes down or is disconnected. An interface can go down if Detect interface status for Gateway Load Balancing does not receive a response from the configured server.

[#5]

Thanks for full description. Actually when I use " diagnose netlink dstmac list" command, it shows me that the threshold has passed. butit does not switch to WAN2. Here is more detail" ==================== config system settings set v4-ecmp-mode usage-based end ==================== edit 1 set device " wan1" set distance 9 set gateway 94.184.251.85 set priority 2 next edit 2 set device " internal" set dst 10.0.0.0 255.255.240.0 set gateway 10.0.10.1 next edit 3 set device " ssl.root" set dst 10.0.11.0 255.255.255.192 next edit 4 set device " wan2" set distance 9 set gateway 192.168.1.1 set priority 6 next ====================== config system interface edit " wan1" set vdom " root" set ip 94.184.251.88 255.255.255.192 set detectserver " 194.225.240.2" set type physical set spillover-threshold 20 set alias " NetCo" next edit " wan2" set vdom " root" set ip 192.168.1.2 255.255.255.0 set type physical set spillover-threshold 100 set alias " MobinNet" next

[Layard]

Set the same value for the priority and the distance for both wan links!