Created on 02-20-2015 01:37 PM Edited on 09-20-2024 04:22 PM By rsondal
Description
This article shows how to configure multiple Internet connections without load-balance.
The interfaces are set for failover using a link-monitor.
Scope
FortiGate.
Solution
This example is considering that both Internet connections are configured with static IP addresses and there is two default routes as static routes.The secondary WAN link will be a standby link and will trigger change once the primary WAN link will be down. If addressing mode on one of the wan interfaces is DHCP, refer to the end of the document.
wan1: 10.5.21.50.
wan2: 10.5.53.50.
Set the IP addresses under System -> Network -> Interfaces:
Note: In FortiOS 6.2 and above, 'interval' is a millisecond value between 500 and 3600000. In 6.0, the value is in seconds between 1 and 3600.
Check the link-monitor status via the CLI with:
diagnose sys link-monitor status
Link Monitor: 0, Status: alive, Server num(1), Flags=0x1 init, Create time: Fri Feb 12 01:52:09 2021
Source interface: port1 (3)
Source IP: 10.10.0.21
Interval: 500 ms
Peer: 8.8.8.8(8.8.8.8)
Source IP(10.5.21.50)
Route: 10.5.21.50 ->8.8.8.8/32, gwy(10.5.31.254)
protocol: ping, state: alive
Latency(Min/Max/Avg): 5.334/5.543/5.450 ms
Jitter(Min/Max/Avg): 0.002/0.122/0.050
Packet lost: 0.000%
Number of out-of-sequence packets: 0
Fail Times(0/5)
Packet sent: 104, received: 104, Sequence(sent/rcvd/exp): 105/105/106
When the WAN1 link goes down, navigate to the system event logs as below and verify the logs:
FortiGate GUI -> Log and Reports > System Event.
Log: the static route is removed Route (10.5.21.50 <-> 8.8.8.8 ping-down).
The above log means that the static route of wan1 is removed and the health check failed.
If the addressing mode on one of the wan interfaces is DHCP, configure the interface to use DHCP:
Use the CLI to set it up as follows:
config system interface
edit "port3"
set vdom "root"
set mode dhcp
set distance 10
set type physical
set snmp-index 3
next
end
Another option is to change the Administrative Distance to 5 on the existing provider interfaces (ports 1 and 2).
Administrative Distance (AD) is set to 5 by default in DHCP or PPPoE mode.
Port1:
Port2:
FortiGate will create a dynamic route when using DHCP as the addressing mode for the interface.
To configure the link-monitor:
config system link-monitor
edit WanDHCPFailover
set srcintf port3 <----- Specify the port used for the DHCP WAN link.
set server 8.8.8.8
set protocol ping
set gateway-ip 0.0.0.0 <----- Leave as 0.0.0.0: the system will add it dynamically.
set source-ip 0.0.0.0
set interval 500
set probe-timeout 500
set failtime 5
set recoverytime 5
set ha-priority 1
set update-cascade-interface enable
set update-static-route enable
set status enable
end
Check the link-monitor status through the CLI with the following command:
diagnose sys link-monitor status
If any further assistance is required, contact Fortinet support.
Related Article:
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.