Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
BusinessUser
Contributor

VRRP static route question

I refer to "set ignore-default-route enable" in Technical Tip: VRRP - Active failover with link-mo... - Fortinet Community

 

edit "lan1"
config vrrp
edit 100
set vrgrp 100
set vrip 10.0.0.254
set priority 200
set vrdst 1.1.1.1
set vrdst-priority 10
set ignore-default-route enable

 

Correct me if I am wrong but the static route should be removed when the VRRP fails so what does "set ignore-default route enable" do?

==================================================================================

 

config system link-monitor
edit "monitor-vrrp-destination"
set srcintf "wan"
set server "1.1.1.1"
set gateway-ip x.x.x.x
set update-static-route disable
next
end

 

What does set update-static-route disable do in this config? Should it be enable instead?

 

 

6 REPLIES 6
bpozdena_FTNT

Hi @BusinessUser ,

 

 

Correct me if I am wrong but the static route should be removed when the VRRP fails so what does "set ignore-default route enable" do?


This is tied to the "set vrdst" option. This option tells VRRP to monitor if route to the VRDST IP address exists in the routing table. If the route disappears from the routing table, the VRRP Master will lower its priority from "set priority" to "set vrdst-priority". The option "set ignore-default-route enable" simply ignores the default route when checking reachability to VRDST.

 

The option should probably be called "set vrdst-ignore-default-route", but it's not :-).

 

In general, if your VRDST is not actually reachable via the default route, you should enable "ignore-default-route".

 

 

 


What does set update-static-route disable do in this config? Should it be enable instead?


The link monitor is not tied just to VRRP, but they can be used in conjunction. Link monitor is just an active probe, which can remove routes from the routing table when the monitored server stops responding. So, if you want VRDST induced failover of VRRP to happen, you will need to keep "update-static-route" enabled.   More on link monitor feature can be found at https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/647723/link-monitor-with-rou... .

 

 

 


HTH,
Boris
fricci_FTNT
Staff
Staff

Hi,

Q: >>..what does "set ignore-default route enable" do?
R: The setting "set ignore-default-route enable" enables ignoring of default route when checking destination.
https://docs.fortinet.com/document/fortigate/6.2.3/cli-reference/10620/system-interface

Q: >>What does set update-static-route disable do in this config? Should it be enable instead?
R: The setting "set update-static-route disable" disables the ability to update the static route. If I understood correctly what you are trying to achieve, you could keep update-static-route disabled if you use "set ignore-default-route enable". I have never worked with that particular config before.
https://community.fortinet.com/t5/FortiGate/Technical-Note-Routing-Change-and-Session-Fail-over-with...
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Bring-other-interfaces-down-when-link-moni...

From article https://community.fortinet.com/t5/FortiGate/Technical-Tip-Link-monitor/ta-p/197504 :
---------------------------------------------------
**set update-static-route “Enable/disable updating the static route, default: enable”
   [** It is advised to keep disabled as it may cause the production environment down , Make sure it's working before enabling it]
---------------------------------------------------

---
If you have found a useful article or a solution, please like and accept it to make it easily accessible to others.
BusinessUser

i dont get it.

what is the difference between "set update-static-route enable  " and "set ignore-default route enable"?

fricci_FTNT

They are two different settings configured under two different contexts, "system interface" and "system link-monitor". You may find the answer from my colleague Boris clearer.

---
If you have found a useful article or a solution, please like and accept it to make it easily accessible to others.
BusinessUser
Contributor

Is there fortigate training video for vrrp or link monitoring?

fricci_FTNT

Hi @BusinessUser,

 

I have checked https://video.fortinet.com/search and https://www.youtube.com/@fortinet/search and so far I could not find anything related to them.

Regards,

---
If you have found a useful article or a solution, please like and accept it to make it easily accessible to others.
Top Kudoed Authors