0

Organisation don't have AS number .As of now we are doing manually route for any ISP at a time. when default Internet link is go down that time making second link enable on firewall.

I saw the some solution on google which is to configure BGP but for that we need organization AS Number. If any alternative for the failover of internet links(different ISP) then Please provide the solution for the case ,we have fortigate 100D firewall .

Improve this question
5
  • 2
    Do you need failover just for outbound or also for inbound connections?
    – Zac67 ♦
    Commented Dec 18, 2018 at 7:14
  • Just for failover for outbound link .
    – Govind Choudhary
    Commented Dec 18, 2018 at 12:28
  • Most ISPs will let you use a private AS number (similar to private addressing) for BGP peering.
    – Ron Trunk
    Commented Dec 18, 2018 at 13:33
  • 1
    Would simple fail over of a default route suffice?
    – Ron Maupin ♦
    Commented Dec 18, 2018 at 15:40
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 31, 2020 at 19:41

2 Answers 2

Reset to default
3

Create 2 default routes (0.0.0.0/0) to the 2 gateway addresses of your ISPs. The secondary one should have a higher distance like 20 as the default distance in FortiOS is 10.

This will guard you from link failure. As soon as one link is down, it's default route is deleted from the routing table, and the other one is added.

You will probably want to watch both connections if they can handle outbound traffic (link failure has it's obvious limits). You can set up remote ping servers which send pings to a public, always-up destination. As soon as the ping server fails, the route is deleted.

This is configured in the CLI. You can specify multiple destination servers which have to fail all together to trigger failover.
Here is an example: 

config system link-monitor
    edit "quad9"
        set srcintf "wan1"
        set server "9.9.9.9" "9.9.9.10"
        set interval 10
    next
end
Improve this answer
0

To accomplish this requirement floating static routes need to configured on firewall . Generally for internet access default route is configured pointing towards ISP gateway . Configure secondary ISP with higher adminstrative distance value (AD) . Secondary default route with higher AD value will be inactive state and becomes active onces primary ISP link fails

IP route 0.0.0.0 0.0.0.0 pointing towards ISP1 gateway 10

IP route 0.0.0.0 0.0.0.0 pointing towards ISP2 gateway 30

Improve this answer
1
  • That's the same answer as above, just less detailed.
    – Zac67 ♦
    Commented Dec 20, 2020 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.