Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 40 subscribers
  • Views 3238 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Enable SD-WAN Zero-impact failover

Suporte Braveo

Hey guys, hope all is going well.

I'd like some guidance on how to enable SD-WAN Zero-impact failover. My setup is pretty basic, with an XGS 2100 and two WAN connections. I have them configured in a fail-over approach (not load balancing), using an SD-WAN profile and route.

Here's the profile:

And the route:

The route precedence is set to "Static route, SD-WAN route, VPN route", with "Policy route doesn’t apply to system-generated and reply traffic".

I don't know if I need to enable or configure something else, but every time there's a route change (primary gateway no longer meets the SLA), there's a drop in WAN connectivity of a few seconds (around 10 or so). When the firewall routes back to the primary gateway, there's another drop.

Did I miss something? Are my settings optimal?

Thanks, everybody.



This thread was automatically locked due to age.
Parents Reply
  • +1 in reply to Vivek Jagad

    Found why! The WAN gateway set as the primary is behind a NAT, so when I enabled reply traffic routing the firewall started to route through it, but since I don't have port forwarding configured, it failed to.

    Everything's working now, and I'll see how the firewall deals with failover from now on.

    Thanks!

Children
Unfiltered HTML