Thread Info
  • State Suggested Answer
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 39 subscribers
  • Views 764 views
  • Users 0 members are here
Options
Suggested

WAN Link Failover not working

Sandra Koehler

Hello,

We just added a secondary ISP and I set it up as a new WAN interface. A laptop plugged into it gets an IP address and can get out to the internet, so I know it is working.

I configured WAN failover (active-backup) and initially didn't modify the rules to include another IP address like 8.8.8.8. So it would fail over if it couldn't contact the gateway IP of the main ISP.

When performing a test by removing the cable from the primary WAN port, it did not seem to fail over properly.

Internet connectivity was not restored through the backup gateway. I was unable to ping google.com and eventually got a message saying it couldn't perform a DNS lookup which I thought was odd.

Now that I added the 8.8.8.8 to the rule, will this work? Or are there other things needed? I don't understand how it accounts for NAT, or the VPN gateway, or anything during a failover. Are there routing or firewall rule changes too?



Edited TAGs
[edited by: Erick Jan at 12:21 AM (GMT -7) on 25 Apr 2024]
Parents
  • 0

    What you are referring to ( Active - Backup Gateway ) is called WLM (WAN Link Management) by Sophos.

    Regarding routing decision, WLM has lowest priority. static/dynamic routing or SDwan routing all have higher priorities.

    For example:

    1- If you have only set a static default route 0.0.0.0/0 to specific gateway (let's say gateway A), even with gateway A failure, FW won't use the second gateway because static route has higher priority.

    2- If you have a SDWAN route with only GW A as gateway and with "Route only through specified gateways" enabled, firewall won't use the second gateway.

    These are just couple of examples and there could be some issues with NAT also. I recommend contacting sophos support or contacting me over private chat to do a live diagnostic check.

Reply
  • 0

    What you are referring to ( Active - Backup Gateway ) is called WLM (WAN Link Management) by Sophos.

    Regarding routing decision, WLM has lowest priority. static/dynamic routing or SDwan routing all have higher priorities.

    For example:

    1- If you have only set a static default route 0.0.0.0/0 to specific gateway (let's say gateway A), even with gateway A failure, FW won't use the second gateway because static route has higher priority.

    2- If you have a SDWAN route with only GW A as gateway and with "Route only through specified gateways" enabled, firewall won't use the second gateway.

    These are just couple of examples and there could be some issues with NAT also. I recommend contacting sophos support or contacting me over private chat to do a live diagnostic check.

Children
Unfiltered HTML