WAN Failover on 60D

[dethangel]

Hi guys,

Just deployed a 60D with 5.20 GA firmware, i'm linking it up to 2 connections:

ISP 1 (WAN 1):

Static IP

ISP 2 (WAN 2):

Dynamic IP 

Ideally, if ISP1's gateway can't be reached, the unit should default to ISP2 (ignoring the fact that services facing ISP1 would fail to work).

With the change to 5.20, how does one configure the above scenario?

The guides have not specified much and my traffic is spilling to both connections (seems like its still running in round robin fashion) - even though i have not selected round robin.

Also, by adjusting the weight will somehow change the interface to DMZ?! ... I have to manually switch it back to WAN1.

Is this a bug? 

Appreciate some advice on this. (or any config i may have gotten wrong.) 

The sonicwall used prior to this works without issue for this matter.

[vjoshi_FTNT]

Hello,

Assuming that the default routes for WAN1 / WAN2 , Firewall policies from LAN to WAN1/WAN2 are already created - Default routes should have equal distance - Priority also should be same, if you want dynamic load balancing ------------------ NOTE: - If you are using the option 'Retrieve default gateway from server' for the dynamic IP wan connection(WAN2), then you need to consider the below :   - Under the Network > Interfaces > Edit the respective interface, When you select the 'DHCP' or 'PPPoE', the default distance applied is '5' - Same can be changed on the interface settings or simply change the distance of the other static route (WAN1) to 5 ----------------- Verify, you see the 2 active default routes under (Network > Routing > Routing Monitor) ----------------- Now using the 2 WAN links for load balancing and also for the failover : - Click on Network > WAN Link Load Balancing > Create interface members (for WAN1 and WAN2) and enable health check to monitor the link)

Cheers !

[emnoc]

OP, you need to look at the virtual-link options you have numerous choice from load-balance type and spill over per  member

set load-balance-mode source-ip-based          Select next hop based on source IP. weight-based             Select next hop based on weight. usage-based              Select next hop based on usage. source-dest-ip-based     Select next hop based on both source and destination IPs. measured-volume-based    Select next hop based on volume.   and quality controls;

 set load-balance-quality-mode none             Disable link quality based load balance. latency-based    Select next hop based on latency. jitter-based     Select next hop based on jitter.

So you have a lot of flexibility to perform what you want you just have to experiment to get your desire effect.

ken

[dethangel]

emnoc wrote:

OP, you need to look at the virtual-link options you have numerous choice from load-balance type and spill over per  member

set load-balance-mode source-ip-based          Select next hop based on source IP. weight-based             Select next hop based on weight. usage-based              Select next hop based on usage. source-dest-ip-based     Select next hop based on both source and destination IPs. measured-volume-based    Select next hop based on volume.   and quality controls;

 set load-balance-quality-mode none             Disable link quality based load balance. latency-based    Select next hop based on latency. jitter-based     Select next hop based on jitter.

So you have a lot of flexibility to perform what you want you just have to experiment to get your desire effect.

ken

Thanks for the reply.

I've followed the cookbook guide, but I'm not too keen on the round robin method - since it'll cycle between both WAN  interfaces for traffic - when I only want it to go to WAN2 when WAN1 is unreachable.

Load balance quality mode is now set to "none".

I opted for source-ip-based instead. But that being set, somehow traffic logs still do show client's requests going out from both WANs (similar to round robin fashion).

I'm running out of ideas as the unit is now down.

I'm contemplating a rollback to firmware 5.11 from its 5.20 GA version currently running.

[mac]

Hi ,

First, you should set ISP1 & ISP2 PING detection methods to GATEWAY, I'm using version 5.2.2 does not operate in this issue.

mac

[dethangel]

mac wrote:

Hi ,

First, you should set ISP1 & ISP2 PING detection methods to GATEWAY, I'm using version 5.2.2 does not operate in this issue.

mac

Thanks for your reply,

Did you follow the guide to create the "Virtual WAN" interface?

Understand there are 2 approaches to this - not sure whether I can use the version for 5.1x config on the 5.2x fortiOS.

[mac]

Hi,

wan load balance is V5.2 New Feature,

Prior versions no function and command,

And ForitOS there is no version 5.1

mac

[vjoshi_FTNT]

- When the default routes have equal distance and priorities, the ecmp takes effect and by default the 'source-ip-based' ecmp method is applied - Having any ecmp method applied, you will have the sessions load balanced on the second link at certain point(when the criteria for that ecmp mode is met). - Round-robin or Source-IP based mode normally use odd-even method - Meaning, Odd numbered session/IP will go via WAN1 and Even numbered will go via WAN2 -------------- If you want only the redundancy as you said "when I only want it to go to WAN2 when WAN1 is unreachable.", in this case have higher priority(even distance if don't want WAN2 link to be used at all untill the WAN1 is completely down) on the WAN2 route and apply the health check under WAN Link Load Balancing > Create interface members (for WAN1 and WAN2) - So, only if the WAN1 cannot reach the ping server which is mentioned in the health check, WAN2 route will be effective and used. Hope that helps