AnsweredHot!ping check wan failover

Author
nordik24
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/12/02 04:21:25
  • Status: offline
2018/03/19 08:03:28 (permalink)
0

ping check wan failover

Hi
 
i have wan1 as my primary interface. I want to add a check that will set the interface down if theres any problem with it reaching internet. In that case i want wan2 to be the primary one.
How do i configure a check that will set wan1 in admin down?
 
thanks
#1
brycemd
Bronze Member
  • Total Posts : 47
  • Scores: 2
  • Reward points: 0
  • Joined: 2016/12/03 11:24:30
  • Status: offline
Re: ping check wan failover 2018/03/19 08:48:48 (permalink) ☼ Best Answerby nordik24 2018/03/19 10:20:31
0
It's CLI only beyond 5.2
 
config system link-monitor
edit 1
set srcintf wan1
set server 8.8.8.8 - or whatever you want to constantly ping
 
If it fails it removes the route so your wan2 route will become the default. There are other values to define if you want, but i believe the above is the minimum to get it working.
 
http://help.fortinet.com/cli/fos50hlp/54/Content/FortiOS/fortiOS-cli-ref-54/config/system/link-monitor.htm
 
#2
ericli_FTNT
Gold Member
  • Total Posts : 127
  • Scores: 4
  • Reward points: 0
  • Joined: 2018/02/08 11:12:27
  • Status: offline
Re: ping check wan failover 2018/03/19 09:23:12 (permalink)
0
nordik24
Hi
 
i have wan1 as my primary interface. I want to add a check that will set the interface down if theres any problem with it reaching internet. In that case i want wan2 to be the primary one.
How do i configure a check that will set wan1 in admin down?
 
thanks




You can take a look at the feature of SD-Wan which offer health-check and load-balance between your two Wan links.
#3
nordik24
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/12/02 04:21:25
  • Status: offline
Re: ping check wan failover 2018/03/19 10:20:24 (permalink)
0
thanks for the clarification
#4
sw2090
Gold Member
  • Total Posts : 202
  • Scores: 10
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: ping check wan failover 2018/03/28 02:52:09 (permalink)
0
Probably the easiest way is to use the built in Loadbalancer (wan-link-load-blanace WLLB).
Set some ping check for availability (in 5.4 or greater this can all be done in webinterface, not sure about older versions though). 
You could set WLLB to do volume based balancing with 100% of traffic on wan1 and none on wan2. This will then route all traffic to the internet via wan1 except if the ping check reports wan1 down. In this very case WLLB will automatically use wan2 instead.
This works fine here on over 16 FortiGates.
 
It however will not affect VPN Tunnels. If you want VPN Fallback you will have to have redundant tunnels on each wans and at least priority based routing. This is how I do this here with our ipsec Tunnels. There es one for every lan from every FGT to our FGT and priority based routing for the subnets going over those.
If then one wan on one side is down that tunnel will drop and it will switch to the second route over the second tunnel within a second.
#5
luckysantiago
New Member
  • Total Posts : 11
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/09/01 23:33:53
  • Status: offline
Re: ping check wan failover 2018/08/09 15:36:44 (permalink)
0
Bumping this thread for some clarification.
 
Not using SD WAN or WLLB just dual ISP with individual static route and priority to enforce primary and backup.
 
Setup is identical to this https://cookbook.fortinet.com/redundant-internet-basic-failover-56/ but i didn't proceed on item no. 4 wondering if there is non cli way of doing this since i'm on new firmware.
 
FortiGate 301E v5.6.4 build1575 (GA)
 
Had an outage on primary today and secondary didn't kicked in so i'm assuming this is the missing piece? During my testing i physically unplugged the primary and the backup kicked in.
#6
tanr
Platinum Member
  • Total Posts : 607
  • Scores: 20
  • Reward points: 0
  • Joined: 2016/05/09 17:09:43
  • Status: offline
Re: ping check wan failover 2018/08/09 18:58:17 (permalink)
0
Yes, you need a link-monitor for it to work properly.
#7
luckysantiago
New Member
  • Total Posts : 11
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/09/01 23:33:53
  • Status: offline
Re: ping check wan failover 2018/08/09 19:13:16 (permalink)
0
When i check "config system link-monitor" settings it is empty, is that normal? that i need to supply every single line on wan interface on this link monitor properties?  Thanks.
#8
zhunissov4
Gold Member
  • Total Posts : 229
  • Scores: 18
  • Reward points: 0
  • Joined: 2015/10/12 04:00:01
  • Status: offline
Re: ping check wan failover 2018/08/09 20:23:44 (permalink)
0
Hello, 
 
Here are minimum configuration for link-monitor:
 
name : TEST
addr-mode : ipv4
srcintf : wan1
server : "8.8.8.8"
protocol : ping
gateway-ip : X.X.X.X
source-ip : 0.0.0.0
interval : 1
failtime : 5
recoverytime : 5
ha-priority : 1
update-cascade-interface: enable
update-static-route : enable
status : enable
 
 
#9
luckysantiago
New Member
  • Total Posts : 11
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/09/01 23:33:53
  • Status: offline
Re: ping check wan failover 2018/08/09 20:41:02 (permalink)
0
gateway-ip is the gateway of the ISP right? is it required for this link-monitor or it can stay on 0.0.0.0 since i already have gateway defined on static route.  thanks!
#10
zhunissov4
Gold Member
  • Total Posts : 229
  • Scores: 18
  • Reward points: 0
  • Joined: 2015/10/12 04:00:01
  • Status: offline
Re: ping check wan failover 2018/08/09 21:03:44 (permalink)
0
gateway-ip is the gateway of the ISP right? 
 
Yes, it is your ISP's ip address. 
 
 
#11
luckysantiago
New Member
  • Total Posts : 11
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/09/01 23:33:53
  • Status: offline
Re: ping check wan failover 2018/08/09 21:50:35 (permalink)
0
Just to clarify, IP Address of the wan interface or the gateway of the wan isp?
#12
zhunissov4
Gold Member
  • Total Posts : 229
  • Scores: 18
  • Reward points: 0
  • Joined: 2015/10/12 04:00:01
  • Status: offline
Re: ping check wan failover 2018/08/09 21:52:05 (permalink)
0
 The gateway of the wan isp (the ip address which set in ISP router)
#13
luckysantiago
New Member
  • Total Posts : 11
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/09/01 23:33:53
  • Status: offline
Re: ping check wan failover 2018/08/16 16:02:07 (permalink)
0
I did this and failover works but, when the primary wan goes up it doesn't automatically revert back to primary and stays on backup link/wan.
 
But is can see on the routing monitor that primary goes back to route as well on the "get router info routing-table all" wan1 is set as default candidate
post edited by luckysantiago - 2018/08/16 16:13:05
#14
luckysantiago
New Member
  • Total Posts : 11
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/09/01 23:33:53
  • Status: offline
Re: ping check wan failover 2018/09/16 17:04:57 (permalink)
0
This is working fine now,  can i add third ISP?
#15
sw2090
Gold Member
  • Total Posts : 202
  • Scores: 10
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: ping check wan failover 2018/09/17 00:32:30 (permalink)
0
Indeed FGT does revert the routing etc but it doesn't revert existing sessions. So your traffic will still go over wan2 until those sessions expire (or you clear them manually). There is some thread on this issue somewhere here...
#16
Jump to:
© 2018 APG vNext Commercial Version 5.5