This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Force RED Tunnels to prioritize WAN connection?

We have a recurring issue with our RED tunnels at sites with multiple WAN connections - here's the scenario:

The UTM is set up with multipath routing / failover so that general traffic goes over WAN1 and the RED tunnel and other priority traffic goes over WAN2.  In the event one WAN or the other goes down, all traffic fails to the active WAN.  This works correctly.  However, when the downed WAN connection comes back up, the RED tunnels never re-establish themselves on the proper WAN unless we manually down the tunnel or restart the device.  Thus we'll end up with a tunnel running over the wrong WAN for weeks after a simple 5 minute outage.

Is there a way to force the RED tunnels to re-establish themselves after a certain interval? Every 24 hours or something?  Or can anyone suggest an alternative fix?  We'd rather not have a scheduled nightly reboot, obviously.



This thread was automatically locked due to age.
Parents
  • Great question!  Since this will require changes done at the command line, you should ask Sophos Support to bless this suggestion before you put it in place.

    1. We need the name of the RED tunnel for SiteA, and learn that it is REF_ItfRedReds1SiteAwith the command
           cc get red servers
    2. To schedule a brief outage every morning at 2AM, add the following line to /etc/crontab-static
           0 2 * * 0,1,2,3,4,5,6 /usr/local/bin/confd-client.plx change_object 'REF_ItfRedReds1SiteA' 'status' 0 && /usr/local/bin/confd-client.plx change_object 'REF_ItfRedReds1SiteA' 'status' 1
    3. To have WebAdmin add this new line to crontab, go to the 'Configuration' tab in 'Management >> Up2Date', change the 'Firmware Download Interval' to a different setting, Apply, change it back and Apply.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • Great question!  Since this will require changes done at the command line, you should ask Sophos Support to bless this suggestion before you put it in place.

    1. We need the name of the RED tunnel for SiteA, and learn that it is REF_ItfRedReds1SiteAwith the command
           cc get red servers
    2. To schedule a brief outage every morning at 2AM, add the following line to /etc/crontab-static
           0 2 * * 0,1,2,3,4,5,6 /usr/local/bin/confd-client.plx change_object 'REF_ItfRedReds1SiteA' 'status' 0 && /usr/local/bin/confd-client.plx change_object 'REF_ItfRedReds1SiteA' 'status' 1
    3. To have WebAdmin add this new line to crontab, go to the 'Configuration' tab in 'Management >> Up2Date', change the 'Firmware Download Interval' to a different setting, Apply, change it back and Apply.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data