Static Route Issue

[#1]

Hi, I have 3 DSL link and all are active at the same time. I have 3 static routes and policy-based routes. Now, I have static route problem, when 1 of the link lost it' s internet connection the static route remain in the routing table. Therefore, my internet traffic will force to use that route, then i can' t browse the web anymore. What should do to automatically remove the static route when 1 of the link is down? Link 1 - DSL1 Link 2 - DSL2 Link 3 - DSL3 What should I do to detect that the internet traffic is down and automatically remove the route in the routing table, so that the failover will work? Many Thanks in advance. Regards, Julz

[MohanFC]

Hi, In the policy route configurations do not configure the gateway. Leave the Gateway with an ip address 0.0.0.0. This would allow the fortigate to remove the routing entry as soon as the DSL1 fails. Also configure the PING server ( refer below link for PING server ) http://kb.fortinet.com/kb/documentLink.do?popup=true&externalID=FD30626&languageId= Regards, Mohan

[ede_pfau]

The FGT will delete the route by default only at link loss. If you want it to check for connectivity loss configure ping servers with targets on the net.

[#4]

Hi Ede, That' s correct the FGT will delete the route when the interface is down, i have tested that also, but my concern now is how to detect the connectivity packet loss. May i know where to configure the connectivity loss ping server? Thanks, Julz

[ede_pfau]

Ping server is configured in System>Network>Interface>WANx, lower half. BTW you can even enter several ping servers, just in case it' s taken down for maintenance.

[#6]

Hi Ede, I' m using FortiOS 4.0 MR2 Patch 3. Before I used FortiOS 3.0 it' s working fine. But now, I have issue on the failover. I didn' t see ping server on version 4, but Detect server and Detect protocol only. It' s already configured, but it does not work when my internet went down. Any suggestions please? Many thanks. Julz

[ede_pfau]

Use dead gateway detection and e-mail alerts Another tool available to you on FortiGate units is the dead gateway detection. This feature allows the FortiGate unit to ping a gateway at regular intervals to ensure it is online and working. When the gateway is not accessible, that interface is marked as down. To detect possible routing loops with dead gateway detection and e-mail alerts 1 To configure dead gateway detection, go to System > Network > Options . 2 Set the detection interval (how often to send a ping), and fail-over detection (how many lost pings before bringing the interface down). A smaller interval and smaller number of lost pings will result in faster detection, but will create more traffic on your network. 3 To configure interface status change notification, go to Log&Report >Log Config > Alert E-mail. 4 After you enter your email details, select the events you want to be alerted about — in our case Configuration changes. You may also want to log CPU and Memory usage as a network outage will cause your CPU activity to spike. After this configuration, when this interface on the FortiGate unit cannot connect to the next router, the FortiGate unit will bring down the interface and alert you with an email to the outage.

from the FortiOS Handbook v4.00MR2, pg. 1322

[#8]

Can you suggest the number of detection interval and fail-over detection? Thanks.

[ede_pfau]

If you multiply both you get the longest time span an interface failure will get unnoticed and traffic will be discarded. Don' t use too few pings, like >= 5, and maybe every 1 or 2 seconds. This way when the IF loses connectivity your users will be in the dark for 5 to 10 seconds which may or may not be acceptable.

[#10]

Many thanks Ede for the insights. I' ll try this configuration and see if it solve the issue. Julz