![]() You can use the device template that we provide below to automatically create custom sensors with the auto-discovery. Adding FortiGate sensors via auto-discovery oidlib file, but you could still use it for other sensors. ![]() ![]() In this article, we describe a different approach that does not use the. If you encounter this issue, see MIB problems: PRTG hangs when adding SNMP library sensor. oidlib file and use the SNMP Library sensor. While PRTG provides a couple of sensors that work with FortiGate firewalls by default, for example the FortiGate System Statistics sensor, the SNMP Traffic sensor, and the SNMP System Uptime sensor, you may still be interested in more detailed sensors.įortiGate has a very extensive SNMP implementation that can lead to issues when you try to import or deploy a complete. Without the HQ probe you have a blackhole since the HQ originated and obviously ROBO return path are still routed to MPLS using the till valid route installed in the RIB of HQ fortigate!!įor statefull established sessions route re-evaluation does not happen until the session expire or a new one is established.This article applies as of PRTG 23 Sensors for FortiGate firewalls On ROBO fortigate of course you have a simmetric configuration. ![]() When the MPLS it's down on any of the two sides, the only route active should be via VPN_ROBO. is directly connected, VPN_ROBO, (this is the floating route with less favorable priority 15) When the MPLS link it's up you have a routing table with both routes installed but with MPLS path preferred/active, something like the following from cli:įGT-LAB # get router info routing-table static Yes you have to configure a link probe on HQ to determine whether the transit network path is working end-to-end and therefore will have to remove the now invalid route when the MPLS link fail.ġ92.168.4.0/24 via device PORT1, gateway 192.168.8.254, distance 5 priority 10ġ92.168.4.0/24 via device VPN_ROBO, distance 5 priority 15 Now I focus on blackhole route for resolve the issue.Īssuming that you have all policy correctly in place and that the tunnel it's working. and related sessions, but I haven't the solution yet. The link monitor on the Branch Office works as I expected, according to the param I have configured the link monitor only in the Branch Office, when the MPLS falls down I tryed to manually change the priority of the static route configured in the HQ for redirect traffic throught the tunnel but nothing changes. In conclusion, if the lines are all up and I manually change the priority of static routes, (privileging the “tunnel route”) the traffic passes through the tunnel correctly, but in case of failover of the MPLS link or in case of router MPLS dead, the packets do not pass through the tunnel, (despite the link monitor works fine) how is it possible? In this case, the only active route to 192.168.8.0/24 network is the “TUNNEL Route”, so I expect the traffic flow through the tunnel towards the newtork head office, but this does not happen. When the ping fails the static route on internal port are deleted from the routing table, as I expect. I have configured in the Branch Office Fortigate a monitor link (dead link detection use ping on 192.168.8.254 using gataway 192.168.4.254). The Tunnel works fine, until the MPLS does not fall. Now I configured a SITE-TO-SITE VPN Tunnel between the two fortigates. In this condition a pc in the head office LAN with gataway 192.168.8.253 (fortigate) reaches a pc of the branch office LAN through MPLS using routers 192.168.8.254 without problems and vice versa. Primary Link MPLS, IP router 192.168.4.254 connected on FG internal interface I have configured a static route to branch office lan 192.168.4.0/24 - gataway 192.168.8.254 on port1 (internal) Primary Link MPLS, IP router 192.168.8.254 connected on FG internal interfaceĪDSL Internet Link is connected to WAN1 port of fortigate I want use a Site-To-Site VPN in a failover scenario but the tunnel seem to be working only if the lines are up. Hi all, I wanna thanks for every advice you can get me.
0 Comments
Leave a Reply. |