Fortinet Document Library

Version:


Table of Contents

New Features

7.0.0
Download PDF
Copy Link

Add weight setting on each link health monitor server 7.0.1

Prior to FortiOS 7.0.1, the link health monitor is determined to be dead when all servers are unreachable. Starting in 7.0.1, the link health monitor can configure multiple servers and allow each server to have its own weight setting. When the link health monitor is down, it will trigger static route updates and cascade interface updates if the weight of all dead servers exceeds the monitor's fail weight threshold.

config system link-monitor
    edit <name>
        set srcintf <interface>
        set server-config {default | individual}
        set fail-weight <integer>
        config server-list
            edit <id>
                set dst <address>
                set weight <integer>
            next
        end
    next
end

server-config

Set the server configuration mode:

  • default: all servers share the same attributes.

  • individual: some attributes can be specified for individual servers.

fail-weight <integer>

Threshold weight to trigger link failure alert (0 - 255, default = 0).

server-list

Configure the servers to be monitored by the link monitor.

dst <address>

Enter the IP address of the server to be monitored.

weight <integer>

Weight of the monitor to this destination (0 - 255, default = 0).

Examples

In the following topology, there are two detect servers that connect to the FortiGate through a router: server 1 (10.1.100.22) and server 2 (10.1.100.55).

Alive link health monitor

In this configuration, one server is dead and one server alive. The failed server weight is not over the threshold, so the link health monitor status is alive.

To configure the weight settings on the link health monitor:
  1. Configure the link health monitor:
    config system link-monitor
        edit "test-1"
            set srcintf "port22"
            set server-config individual
            set gateway-ip 172.16.202.1
            set failtime 3
            set fail-weight 40
            config server-list
                edit 1
                    set dst "10.1.100.22"
                    set weight 60
                next
                edit 2
                    set dst "10.1.100.55"
                    set weight 30
                next
            end
        next
    end
  2. Trigger server 2 to go down. The link monitor is still alive because the fail weight threshold has not been reached.
  3. Verify the link health monitor status:
    # diagnose sys link-monitor status test-1
    Link Monitor: test-1, Status: alive, Server num(2), HA state: local(alive), shared(alive)
    Flags=0x1 init, Create time: Fri Jun  4 17:23:29 2021
    Source interface: port22 (14)
    Gateway: 172.16.202.1
    Interval: 500 ms
    Service-detect: disable
    Diffservcode: 000000
    Class-ID: 0
    Fail-weight (40): not activated
      Peer: 10.1.100.22(10.1.100.22)
            Source IP(172.16.202.2)
            Route: 172.16.202.2->10.1.100.22/32, gwy(172.16.202.1)
            protocol: ping, state: alive
                    Latency(Min/Max/Avg): 0.417/0.585/0.530 ms
                    Jitter(Min/Max/Avg): 0.007/0.159/0.057
                    Packet lost: 0.000%
                    Number of out-of-sequence packets: 0
                    Fail Times(0/3)
                    Packet sent: 239, received: 236, Sequence(sent/rcvd/exp): 240/240/241
      Peer: 10.1.100.55(10.1.100.55)
            Source IP(172.16.202.2)
            Route: 172.16.202.2->10.1.100.55/32, gwy(172.16.202.1)
            Fail weight 30 applied
            protocol: ping, state: dead
                    Packet lost: 100.000%
                    Number of out-of-sequence packets: 0
                    Recovery times(0/5) Fail Times(1/3)
                    Packet sent: 239, received: 3, Sequence(sent/rcvd/exp): 240/4/5

Dead link health monitor

In this configuration, one server is dead and one server alive. The failed server weight is over the threshold, so the link health monitor status is dead.

To configure the weight settings on the link health monitor:
  1. Configure the link health monitor:
    config system link-monitor
        edit "test-1"
            set srcintf "port22"
            set server-config individual
            set gateway-ip 172.16.202.1
            set failtime 3
            set fail-weight 40
            config server-list
                edit 1
                    set dst "10.1.100.22"
                    set weight 30
                next
                edit 2
                    set dst "10.1.100.55"
                    set weight 50
                next
            end
        next
    end
  2. Trigger server 2 to go down. The link monitor is dead because the fail weight threshold has been reached.
  3. Verify the link health monitor status:
    # diagnose sys link-monitor status  test-1
    Link Monitor: test-1, Status: dead, Server num(2), HA state: local(dead), shared(dead)
    Flags=0x9 init log_downgateway, Create time: Fri Jun  4 17:23:29 2021
    Source interface: port22 (14)
    Gateway: 172.16.202.1
    Interval: 500 ms
    Service-detect: disable
    Diffservcode: 000000
    Class-ID: 0
    Fail-weight (40): activated
      Peer: 10.1.100.22(10.1.100.22)
            Source IP(172.16.202.2)
            Route: 172.16.202.2->10.1.100.22/32, gwy(172.16.202.1)
            protocol: ping, state: alive
                    Latency(Min/Max/Avg): 0.393/0.610/0.520 ms
                    Jitter(Min/Max/Avg): 0.009/0.200/0.095
                    Packet lost: 0.000%
                    Number of out-of-sequence packets: 0
                    Fail Times(0/3)
                    Packet sent: 680, received: 677, Sequence(sent/rcvd/exp): 681/681/682
      Peer: 10.1.100.55(10.1.100.55)
            Source IP(172.16.202.2)
            Route: 172.16.202.2->10.1.100.55/32, gwy(172.16.202.1)
            Fail weight 50 applied
            protocol: ping, state: dead
                    Packet lost: 100.000%
                    Number of out-of-sequence packets: 0
                    Recovery times(0/5) Fail Times(1/3)
                    Packet sent: 680, received: 3, Sequence(sent/rcvd/exp): 681/4/5

Add weight setting on each link health monitor server 7.0.1

Prior to FortiOS 7.0.1, the link health monitor is determined to be dead when all servers are unreachable. Starting in 7.0.1, the link health monitor can configure multiple servers and allow each server to have its own weight setting. When the link health monitor is down, it will trigger static route updates and cascade interface updates if the weight of all dead servers exceeds the monitor's fail weight threshold.

config system link-monitor
    edit <name>
        set srcintf <interface>
        set server-config {default | individual}
        set fail-weight <integer>
        config server-list
            edit <id>
                set dst <address>
                set weight <integer>
            next
        end
    next
end

server-config

Set the server configuration mode:

  • default: all servers share the same attributes.

  • individual: some attributes can be specified for individual servers.

fail-weight <integer>

Threshold weight to trigger link failure alert (0 - 255, default = 0).

server-list

Configure the servers to be monitored by the link monitor.

dst <address>

Enter the IP address of the server to be monitored.

weight <integer>

Weight of the monitor to this destination (0 - 255, default = 0).

Examples

In the following topology, there are two detect servers that connect to the FortiGate through a router: server 1 (10.1.100.22) and server 2 (10.1.100.55).

Alive link health monitor

In this configuration, one server is dead and one server alive. The failed server weight is not over the threshold, so the link health monitor status is alive.

To configure the weight settings on the link health monitor:
  1. Configure the link health monitor:
    config system link-monitor
        edit "test-1"
            set srcintf "port22"
            set server-config individual
            set gateway-ip 172.16.202.1
            set failtime 3
            set fail-weight 40
            config server-list
                edit 1
                    set dst "10.1.100.22"
                    set weight 60
                next
                edit 2
                    set dst "10.1.100.55"
                    set weight 30
                next
            end
        next
    end
  2. Trigger server 2 to go down. The link monitor is still alive because the fail weight threshold has not been reached.
  3. Verify the link health monitor status:
    # diagnose sys link-monitor status test-1
    Link Monitor: test-1, Status: alive, Server num(2), HA state: local(alive), shared(alive)
    Flags=0x1 init, Create time: Fri Jun  4 17:23:29 2021
    Source interface: port22 (14)
    Gateway: 172.16.202.1
    Interval: 500 ms
    Service-detect: disable
    Diffservcode: 000000
    Class-ID: 0
    Fail-weight (40): not activated
      Peer: 10.1.100.22(10.1.100.22)
            Source IP(172.16.202.2)
            Route: 172.16.202.2->10.1.100.22/32, gwy(172.16.202.1)
            protocol: ping, state: alive
                    Latency(Min/Max/Avg): 0.417/0.585/0.530 ms
                    Jitter(Min/Max/Avg): 0.007/0.159/0.057
                    Packet lost: 0.000%
                    Number of out-of-sequence packets: 0
                    Fail Times(0/3)
                    Packet sent: 239, received: 236, Sequence(sent/rcvd/exp): 240/240/241
      Peer: 10.1.100.55(10.1.100.55)
            Source IP(172.16.202.2)
            Route: 172.16.202.2->10.1.100.55/32, gwy(172.16.202.1)
            Fail weight 30 applied
            protocol: ping, state: dead
                    Packet lost: 100.000%
                    Number of out-of-sequence packets: 0
                    Recovery times(0/5) Fail Times(1/3)
                    Packet sent: 239, received: 3, Sequence(sent/rcvd/exp): 240/4/5

Dead link health monitor

In this configuration, one server is dead and one server alive. The failed server weight is over the threshold, so the link health monitor status is dead.

To configure the weight settings on the link health monitor:
  1. Configure the link health monitor:
    config system link-monitor
        edit "test-1"
            set srcintf "port22"
            set server-config individual
            set gateway-ip 172.16.202.1
            set failtime 3
            set fail-weight 40
            config server-list
                edit 1
                    set dst "10.1.100.22"
                    set weight 30
                next
                edit 2
                    set dst "10.1.100.55"
                    set weight 50
                next
            end
        next
    end
  2. Trigger server 2 to go down. The link monitor is dead because the fail weight threshold has been reached.
  3. Verify the link health monitor status:
    # diagnose sys link-monitor status  test-1
    Link Monitor: test-1, Status: dead, Server num(2), HA state: local(dead), shared(dead)
    Flags=0x9 init log_downgateway, Create time: Fri Jun  4 17:23:29 2021
    Source interface: port22 (14)
    Gateway: 172.16.202.1
    Interval: 500 ms
    Service-detect: disable
    Diffservcode: 000000
    Class-ID: 0
    Fail-weight (40): activated
      Peer: 10.1.100.22(10.1.100.22)
            Source IP(172.16.202.2)
            Route: 172.16.202.2->10.1.100.22/32, gwy(172.16.202.1)
            protocol: ping, state: alive
                    Latency(Min/Max/Avg): 0.393/0.610/0.520 ms
                    Jitter(Min/Max/Avg): 0.009/0.200/0.095
                    Packet lost: 0.000%
                    Number of out-of-sequence packets: 0
                    Fail Times(0/3)
                    Packet sent: 680, received: 677, Sequence(sent/rcvd/exp): 681/681/682
      Peer: 10.1.100.55(10.1.100.55)
            Source IP(172.16.202.2)
            Route: 172.16.202.2->10.1.100.55/32, gwy(172.16.202.1)
            Fail weight 50 applied
            protocol: ping, state: dead
                    Packet lost: 100.000%
                    Number of out-of-sequence packets: 0
                    Recovery times(0/5) Fail Times(1/3)
                    Packet sent: 680, received: 3, Sequence(sent/rcvd/exp): 681/4/5