Dual Internet Connections ( Without Load-Balance)

[Oswald]

Hello,

I have a Fortigate 90D (Firmware Version: 5.4.10,build1220) with the following configuration:

wan1 - connected to cable ISP

wan2 - connected to 4G ISP

I want all internet traffic to go through wan1, unless wan1 loses internet connection. In that case, I'd like to failover to wan2.

I added 2 static routes (1 for each interface ) and set the Administrative Distance of both to 10. I set the priority of wan1 to 0 and set the priority of wan2 to 10.

I then set a link-monitor with the following configuration:

ROUTER (link-monitor) # sh full-configuration
config system link-monitor
    edit "Wan1Failover"
        set srcintf "wan1"
        set server "8.8.8.8"
        set protocol ping
        set gateway-ip <gateway ip omitted>
        set source-ip 0.0.0.0
        set interval 5
        set timeout 1
        set failtime 5
        set recoverytime 5
        set ha-priority 1
        set update-cascade-interface enable
        set update-static-route enable
        set status enable
    next
    edit "Wan2Failover"
        set srcintf "wan2"
        set server "8.8.8.8"
        set protocol ping
        set gateway-ip <gateway ip omitted>
        set source-ip 0.0.0.0
        set interval 5
        set timeout 1
        set failtime 5
        set recoverytime 5
        set ha-priority 1
        set update-cascade-interface enable
        set update-static-route enable
        set status enable
    next
end

My hope here is that if/when wan1 goes down all traffic will shift to wan2. Once wan1 becomes available, all traffic will shift from wan2 to wan1. I largely followed this kb article: https://kb.fortinet.com/kb/documentLink.do?externalID=FD36151

Does this configuration satisfy these requirements?

[Toshi_Esumi · Accepted solution]

You don't need to monitor WAN2 because you want to failover from the main(WAN1) to backup(WAN1) without splitting traffic. Then should work.

Just make sure you don't have any default routes/gateways via DHCP or PPPoE from those ISPs. You can disable it with "set defaultgw disable" in the interface config if that's the case.

[Toshi_Esumi]

A typo: ...to backup(WAN2)...

[Oswald]

toshiesumi wrote:

You don't need to monitor WAN2 because you want to failover from the main(WAN1) to backup(WAN1) without splitting traffic. Then should work.

Just make sure you don't have any default routes/gateways via DHCP or PPPoE from those ISPs. You can disable it with "set defaultgw disable" in the interface config if that's the case.

So then, if I'm understanding you correctly I can remove all of the following:

    edit "Wan2Failover"
        set srcintf "wan2"
        set server "8.8.8.8"
        set protocol ping
        set gateway-ip <gateway ip omitted>
        set source-ip 0.0.0.0
        set interval 5
        set timeout 1
        set failtime 5
        set recoverytime 5
        set ha-priority 1
        set update-cascade-interface enable
        set update-static-route enable
        set status enable
    next

How do I remove this, using the command line? 

Also, none of the wan interfaces are configured via. DHCP they are all assigned static.

[Toshi_Esumi]

delete "Wan2Failover"