Redundant Internet IT ALWAYS GOING TO SECONDARY ISP it is not coming back to main ISP

[Niyas]

hi

I have Fortigate 100E with firmware v6.2.3 build1066 (GA). i am implementing redundant internet fail over, My main ISP i configured on WAN1,  my backup internet (DSL) i configured on WAN2. SO i need  always my users should go to wan1 if wan1 fails only switch to wan2(secondary ISP with limited speed) once the wan1 internet service came back it should go back automatically to wan1

unfortunately for me it is not working if wan1 fails it is going to wan2 but when wan1 comes back it not coming back to wan1. it is staying always with wan2. can any one help me on this please find the below my configuration details Note: ISP_MAIN : static ip, ISP_SEC dhcp config system link-monitor  edit ISP_MAIN          (wan1) #get                   set name ISP_MAIN                   set server 8.8.4.4                   set protocol ping                   set gateway-ip 17.124.19.15                   set interval 500                   set timeout 1                   set failtime 5                   set recoverytime 5                   set update-cascade-interface enable                   set update-static-route enable                   set status enable                 end                                   config system link-monitor  edit ISP_SEC          (wan2) #get                   set name ISP_SEC                   set server 8.8.4.4                   set protocol ping                   set gateway-ip 10.99.99.1                   set interval 500                   set timeout 1                   set failtime 5                   set recoverytime 5                   set update-cascade-interface enable                   set update-static-route enable                   set status enable                 end                  TEST_LAB (link-monitor) # get ISP_MAIN name                : ISP_MAIN addr-mode           : ipv4 srcintf             : wan1 server              : "8.8.4.4" protocol            : ping gateway-ip          : 17.124.19.15 source-ip           : 0.0.0.0 interval            : 500 failtime            : 5 recoverytime        : 5 ha-priority         : 1 update-cascade-interface: enable update-static-route : enable status              : enable TEST_LAB (link-monitor) # get ISP_SEC name                : ISP_SEC addr-mode           : ipv4 srcintf             : wan2 server              : "8.8.4.4" protocol            : ping gateway-ip          : 10.99.99.1 source-ip           : 0.0.0.0 interval            : 500 failtime            : 5 recoverytime        : 5 ha-priority         : 1 update-cascade-interface: enable update-static-route : enable status              : enable **** instatic Routing i added for both ISP, ISP_MAIN PRIORITY =0, secondary isp (ISP_SEC)= 10

[tioeudes]

There was a bug id about this on 5.6.11. If you're link monitor configuration is correct as appears to be, it's possible that this bug is happening again.

Test this, try to run the command "execute router restart" after wan1 is back to see if the traffic goes back to be routed to it.

if it does, open a ticket on fortinet.

regards,

tioeudes

[Dave_Hall]

What you may want to do is set up SD-WAN for the two WAN connections - that link will explain more about setting this up.

[James_G]

Can you make both distance and priority higher value on failover

[Khayzzer]

I want to use that method with a LTE wan connection as a secondary WAN and don't want to have that kind of issue as it will cost a lot of money if the connection stays on the LTE. Were you able to solve your problem ?

Thanks

[boneyard]

doesnt seem the original person is going to answer. but i can say for certain that with SD-WAN configured fallback once it is ok again works fine.