Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 3 subscribers
  • Views 10191 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Delay in Multipath Rule taking effect

Aaron Jackson

Hello. First post in the community, so, I'll try not to newb it up too much.

I have a pair of SG210's (in HA) with UTM 9 v 9.351-3 that servers a 24/7 call center that has 3 different Internet Service Providers.

It has been working without much issue, but, we just added the 3rd provider that is an MPLS direct to their servers, so that all of our traffic between our devices and them goes directly to them. I have successfully created the Multipath rule, and it tests fine using a "Test PC Group" definition that I created. However, when I add a new PC to the test group, it is taking upwards of 10 hours before the newly added PC's traffic to the defined destinations begins routing correctly.

I have rebooted the newly added PC's with no change. I leave for the evening, come back in the morning, view the Flow Monitor, and they're all routing correctly.

I'm trying to hit a "Go Live" target for the entire center to be switched over by Thursday, but, I was hoping to roll-out gradually while trying to identify any other issues/quality/reliability... but, having to wait overnight every time is making it very difficult.

The call center can have ZERO down-time, so, rebooting the UTM devices, or anything that would cause HA or such is out of the question, unfortunately.

Any ideas on how to make newly added PC's start routing traffic according to a Multipath rule immediately?

(I'm guessing it has something to do with routing tables...)

 

I know my way around the web UI okay, but, have never shelled into the device.

 

Thanks, in advance, for any help!

Aaron



This thread was automatically locked due to age.
Parents
  • 0

    Hi, Aaron, and welcome to the UTM Community!

    Even though you have bound certain traffic to a specific Interface, each individual connection stays where it is until the connection is broken.  Since working at the command line can void your support contract, I would suggest you ask Sophos Support for the command to do what you want to do.  If they say grace over it, you can use it.  Please come back and share as I'm curious if one of my ideas is what they use.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Thanks, Bob.

    I got a return call (went to voicemail) that I haven't had a chance to return, yet. In the interim, I found that if I disable the rule itself for a solid 10-15 minutes, then re-enable it, the added "test PCs" start utilizing the new rule.

    I had realized (and was grateful) that it didn't "break existing connections", however, I was watching for them to have a window of no traffic affected by the rule, and was then switching them over, but, I'm guessing "having no traffic" wasn't a clean enough break - and something was cached/lingering.

    Thanks for the quick reply. Once I speak with them, I'll let you know what they recommend.

    Thanks, again!

    Aaron

  • 0 in reply to Aaron Jackson

    15 minutes is the default persistence timeout:

    So, it looks like you have hit on the answer to this issue.  I hadn't thought about disabling the current rule to force a switchover, but you rightly concluded from my observation that disabling a rule temporarily would force new traffic over the new rule and let existing connections stay where they were.  Great insight, Aaron!

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0 in reply to Aaron Jackson

    15 minutes is the default persistence timeout:

    So, it looks like you have hit on the answer to this issue.  I hadn't thought about disabling the current rule to force a switchover, but you rightly concluded from my observation that disabling a rule temporarily would force new traffic over the new rule and let existing connections stay where they were.  Great insight, Aaron!

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data
Unfiltered HTML