Fortigate – Link Monitoring and Failover Configuration

failoverfirewallfortigateisprouter

]3i am trying for a failover between two ISP interfaces using link-monitor in fortigate. both ISP links are vlan interface ( ie, not physical). and with my primary ISP, i have eBGP. i need to monitor the link performance, when packet loss through link, make bgp down, so that traffic will be shifted to ISP 2 ( i have static default route through ISP 2 with higher metric).
But in fortigate i have only make interface down ( which is not a good idea obviously) or remove static route through that interface ( which won't work for me, my last mile protocol is eBGP).
If any body is able to give any work around, it will be great.

device configuration
config system link-monitor
edit "to_105"
set srcintf "wan"
set server "xx.xx.xx.xx"
set protocol http
set gateway-ip yy.yy.yy.yy
set update-cascade-interface enable
set update-static-route enable

Best Answer

i got confirmation from fortinet that, link-monitor wont be able to control dynamic routing protocol.

Related Solutions

Routing – Policy routing configuration in Fortigate

Since policy routes are evaluated top-down, you can work around this limit by placing a more specific entry matching traffic from internal subnet A to internal subnet B.

However, this should be less than comfortable if you have many different networks attached to your internal interface.

In this case, I would recommend you a trick I once used: since Fortigate devices ignore QoS marks, you should sign your "internet" packets on the firewall-facing port of your Cisco switch with a specific TOS and then use that mark in your policy-route.

Cisco PBR verify-availability with interface instead of next-hop

As discussed in chat, PBX / SIP traffic is unique to an IP host route in your case. Therefore, you can remove PBR and use tracking objects on overlapping static routes, which go out different dialer interfaces to solve the problem.

ip route 89.123.45.10 255.255.255.255 Dial0 track 1 1 name PBX_Pri
ip route 89.123.45.10 255.255.255.255 Dial1 track 2 10 name PBX_Bak
ip route 0.0.0.0 0.0.0.0 Dial 1 track 2 1 name Data_Pri
ip route 0.0.0.0 0.0.0.0 Dial 0 track 1 10 name Data_Bak

Best Answer

Related Solutions

Routing – Policy routing configuration in Fortigate

Cisco PBR verify-availability with interface instead of next-hop

Related Topic