WAN connection Link-Monitoring

[catalin_alexandru]

Hello. 

I have a Fortigate 60E with 2 WAN connection. One is static IP (wan1 - main), other is PPoE (wan2 - backup).

S* 0.0.0.0/0 [10/0] via 89.xxx.xx.253, wan1, [1/0]                    [10/0] via 82.xx.xxx.1, wan2, [2/0] C 10.0.0.1/32 is directly connected, ppp1 C 82.xx.xxx.30/32 is directly connected, ppp1 C 89.xxx.xx.252/30 is directly connected, wan1 C 192.168.100.0/23 is directly connected, internal

Same distance, and different priority.

I try to configure link-monitor, when wan1 is down, all user inside my network get out traffic using wan2:

config system link-monitor edit "wan1 Failover" set srcintf "wan1" set server "8.8.8.8" set gateway-ip 89.xxx.xx.253 set update-cascade-interface disable next edit "Wan2 Failover" set srcintf "wan2" set server "8.8.8.8" set gateway-ip 82.xx.xxx.1 set update-cascade-interface disable next

Is the correct setting? 

Best regards!

[orani]

Why don't you try SD-WAN?

[catalin_alexandru]

Because i already have a lot of IPv4 policy and i have to reconfigure all. This is not an option.

On show the question is: 

set update-cascade-interface (enable or disable )?

set update-static-route (enable or disable) ?

[orani]

What about policy routing?

[catalin_alexandru]

How to use policy route for wan redundancy? :)

I remain to my main request, in link-monitor :

    set update-cascade-interface (enable or disable )?     set update-static-route (enable or disable) ?

Thank you !

[brycemd]

disabling the cascade is fine, and enable update-static-route which is default anyways.

What you posted should work, however you likely don't need a monitor for WAN2. Since WAN1 is your primary, WAN2 will never be active unless WAN1 fails. So monitoring it to remove the route isn't really needed

Also, even though it's not SD-WAN, the link monitor status can be seen in Monitor > SD-WAN(depending on what version you are on it may be called something else)

[Toshi_Esumi]

FYI: "diag sys link-monitor status" in CLI

[catalin_alexandru]

Thank you for your answer. 

It's harder to do connection tests because the system is in production almost 24 out of 24. I will delete the monitoring for wan2, unless it makes sense for the main one to be.

I monitor ping to the DNS server of  my provider. On Google DNS servers sometimes timeouts appear for a few seconds, enough for the system to set the main route down. What do you think, use gateway or dns provided by provider or google dns / open dns?

[Lucascat]

You can use multiple IP to monitor the link status...