1

I have 3 WAN connections and a remote site with a single WAN address. What I'd like to do is monitor the latency towards the remote site using a single machine (Opsview) on our LAN but through all 3 WAN links. I know I can tag the packets using DSCP but I wasnt able to determine if it's possible to route the traffic via the Fortigate unit accordingly.

  • If you want to monitor things like latency, there are things like IP SLA to do that. Marking with DSCP can be used with QoS to give preferential treatment to certain traffic. For instance, you probably want most of your traffic to remain as BE, but things like VoIP should get priority, and things like server backups should get the worst treatment to prevent them from hogging the bandwidth. This only works within your network; ISPs will ignore your DSCP markings and policies, and it is likely that everything will be set to BE as it crosses the Internet. – Ron Maupin Jul 20 '16 at 14:56
  • @RonMaupin I believe the OP is just seeking to use DSCP tags locally as a means to differentiate between the 3 paths in a PBR rule (the tagging being done on the Opsview server I assume), not to actually send VoIP down one and backups down another. However, the fact that your DSCP markings could get removed by the ISP, as you suggest, could be a problem for ensuring that the return path is the same as the initial path, unless the device on the remote site has some sort of proprietary mechanism in its session table that guarantees that. – Jeremy Gibbons Jul 21 '16 at 6:24
  • That's actually routing 101. If I initiate the traffic through 1.1.1.1, there's no way for the other end to send it back anywhere else besides my origin. Even if the ISP removes the tags it doesnt matter as it's only for me to tell my router "take these packets and send them through this gateway". – JustAGuy Jul 25 '16 at 13:33
1

You want to configure up policy based routing. In the gui this is found: Router > Static > Policy Routes. You can do this by using TOS rather than DSCP.

WAN1: Incoming interface: LAN Source Address: Opsview Machine IP Destination Address: Remote Site WAN IP TOS: Assigned Value Outgoing Interface: WAN1 Gateway Address: Next-hop for that WAN.

Do the same for the other WAN links changing the appropriate values.

| improve this answer | |
  • Would you happen to know what's the difference between Bit Mask and Bit Pattern? – JustAGuy Jul 25 '16 at 13:34
  • You can use it in a similar way to a subnet mask. You can allow for a range to tos values. Page 26 of this Fortigate Documentation talks about it: docs.fortinet.com/uploaded/files/1953/…. – Firebirdnz Jul 26 '16 at 0:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.