I am seeking some advice. I have two different clients with dual WAN setups and I believe that I am running the redundancy incorrectly. I have essentially the same question for both setups so I will just describe one.
I have 2 Fortigate 40Cs setup in HA with WAN1 running off of a DSL connection and WAN2 going through our VOIP internet connection (also DSL, but separate from the main connection). I have the priority and distance set higher for WAN2 and everything seemed to work well. Although I must admit I didn't really believe that the setup was complete. The failover from WAN1 to WAN2 works perfectly if the WAN1 modem was powered down or physically disconnected from WAN1. In this case all traffic would be routed through WAN2. When WAN1 would come back up everything would route through WAN1.
The issue I ran into which I'm sure most of you probably already see is that if the internet for WAN1 died, without the device going down or being removed (ie, if I were to unplug the phone cable from the DSL modem but leave the modem on and connected to WAN1) the firewall wouldn't fail over to WAN2.
Obviously I need to implement some form of ping test via the Fortigate to accomplish what I need. My issue is that it seems to me that for me to do this I need to implement health link monitor which necessarily requires WAN link load balancing (running 5.2.7 right now btw) But, I think there should be an easier way and that's where you come in! It looks like in order to set up WAN link load balancing I would essentially have to start over with all of the policies on these devices. Plus I don't really want the load balancing feature. In my research (and a bit from memory as I have been working with Fortigates on and off for quite a few years) I recall that something like this was at one point much easier with the gwdetect command. But, that is no longer available?
What I am really hoping someone will tell me is that there are some commands that will run a ping test via WAN1 that will bring the interface down when it fails. That would solve my problems.
Thanks in advance for your assistance!
- Mike Page