WAN LLB: Priority of ppp1

[tim_frodermann]

Hello all,

I have a weird thing with a ppp connection. On a 100D I have 4 Internet uplinks:

WAN1 = 10 Mbit SDSL with a provider router between Fortigate and Internet

WAN2 = 10 Mbit SDSL with a provider router between Fortigate and Internet

Port 1 = LTE Router

Port 3 = 150/25 Mbit VDSL with a modem / pppoe

The uplink on port3 is new, the other three have been there for years and we have set them up as a) redundant internet connections and b) there are also policy routes active (sending http(s) over WAN2).

These are the static routing entries:

All 4 links have a distance of 10.

config router static
edit 1
set gateway 62.X.X.X
set priority 1
set device "wan1"
next
edit 2
set gateway 80.X.X.X
set priority 20
set device "wan2"
next
edit 3
set gateway 192.168.8.254
set priority 30
set device "port1"
next
[...]
edit 8
set priority 100
set device "port3"
set dynamic-gateway enable
next

The routing table somehow looks like this (I had taken the LTE offline for maintenance while screenshotting this, normally it is in there, too, with it's correct priority):

So what's happening and what can be seen with a simple sniffing is, that the ppp-connection is always preferred.

Is that a thing with ppp connections on fortigates? It obviously does not show up as port3 but rather as ppp1 and I cannot alter the priority of device "ppp1". It even looks as if it just has no priority.

Has anyone seen this before and what would be the solution?

Thanks in advance for your help.

Have a great day!

Tim

[pasi_villman]

Hi, If I remember correct you should set the distance/priority for dynamic gateway routes directly under interface via cli. config system interface edit <interface name> set distance/priority xxx end Static routes do not have affect on PPoE/DHCP leared gateway routes.

[tim_frodermann]

Hello,

just for a follow-up. 

You were absolutely right. The trick was to set the priority on the interface (not on "ppp1" but on "portX").

The new priority is not active right away, though. You have to restart the FGT or at least reconnect the interface.

Thanks for your help!

Tim