VRRP static route question

[BusinessUser]

I refer to "set ignore-default-route enable" in Technical Tip: VRRP - Active failover with link-mo... - Fortinet Community

edit "lan1"
config vrrp
edit 100
set vrgrp 100
set vrip 10.0.0.254
set priority 200
set vrdst 1.1.1.1
set vrdst-priority 10
set ignore-default-route enable

Correct me if I am wrong but the static route should be removed when the VRRP fails so what does "set ignore-default route enable" do?

==================================================================================

config system link-monitor
edit "monitor-vrrp-destination"
set srcintf "wan"
set server "1.1.1.1"
set gateway-ip x.x.x.x
set update-static-route disable
next
end

What does set update-static-route disable do in this config? Should it be enable instead?

[bpozdena_FTNT]

Hi @BusinessUser ,

Correct me if I am wrong but the static route should be removed when the VRRP fails so what does "set ignore-default route enable" do?

---

This is tied to the "set vrdst" option. This option tells VRRP to monitor if route to the VRDST IP address exists in the routing table. If the route disappears from the routing table, the VRRP Master will lower its priority from "set priority" to "set vrdst-priority". The option "set ignore-default-route enable" simply ignores the default route when checking reachability to VRDST.

The option should probably be called "set vrdst-ignore-default-route", but it's not :-).

In general, if your VRDST is not actually reachable via the default route, you should enable "ignore-default-route".

---

What does set update-static-route disable do in this config? Should it be enable instead?

---

The link monitor is not tied just to VRRP, but they can be used in conjunction. Link monitor is just an active probe, which can remove routes from the routing table when the monitored server stops responding. So, if you want VRDST induced failover of VRRP to happen, you will need to keep "update-static-route" enabled.   More on link monitor feature can be found at https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/647723/link-monitor-with-rou... .

---

[fricci_FTNT]

Hi,

Q: >>..what does "set ignore-default route enable" do?
R: The setting "set ignore-default-route enable" enables ignoring of default route when checking destination.
https://docs.fortinet.com/document/fortigate/6.2.3/cli-reference/10620/system-interface

Q: >>What does set update-static-route disable do in this config? Should it be enable instead?
R: The setting "set update-static-route disable" disables the ability to update the static route. If I understood correctly what you are trying to achieve, you could keep update-static-route disabled if you use "set ignore-default-route enable". I have never worked with that particular config before.
https://community.fortinet.com/t5/FortiGate/Technical-Note-Routing-Change-and-Session-Fail-over-with...
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Bring-other-interfaces-down-when-link-moni...

From article https://community.fortinet.com/t5/FortiGate/Technical-Tip-Link-monitor/ta-p/197504 :
---------------------------------------------------
**set update-static-route “Enable/disable updating the static route, default: enable”
   [** It is advised to keep disabled as it may cause the production environment down , Make sure it's working before enabling it]
---------------------------------------------------

[BusinessUser]

i dont get it.

what is the difference between "set update-static-route enable  " and "set ignore-default route enable"?

[fricci_FTNT]

They are two different settings configured under two different contexts, "system interface" and "system link-monitor". You may find the answer from my colleague Boris clearer.

[BusinessUser]

Is there fortigate training video for vrrp or link monitoring?

[fricci_FTNT]

Hi @BusinessUser,

I have checked https://video.fortinet.com/search and https://www.youtube.com/@fortinet/search and so far I could not find anything related to them.

Regards,