D-Link DFL-860E User Manual for DFL-260E - Page 176
Re-enabling Routes, Route Interface Grouping, 2.3. Route Failover
View all D-Link DFL-860E manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 176 highlights
4.2.3. Route Failover Chapter 4. Routing enabled. Route monitoring for the second, alternate route is not meaningful since it has no failover route. Route # 1 2 Interface wan wan Destination all-nets all-nets Gateway 195.66.77.1 193.54.68.1 Metric 10 20 Monitoring On Off When a new connection is about to be established to a host on the Internet, a route lookup will result in the route that has the lowest metric being chosen. If the primary WAN router should then fail, this will be detected by NetDefendOS, and the first route will be disabled. As a consequence, a new route lookup will be performed and the second route will be selected with the first one being marked as disabled. Re-enabling Routes Even if a route has been disabled, NetDefendOS will continue to check the status of that route. Should the route become available again, it will be re-enabled and existing connections will automatically be transferred back to it. Route Interface Grouping When using route monitoring, it is important to check if a failover to another route will cause the routing interface to be changed. If this could happen, it is necessary to take some precautionary steps to ensure that policies and existing connections will be maintained. To illustrate the problem, consider the following configuration: Firstly, there is one IP rule that will NAT all HTTP traffic destined for the Internet through the wan interface: Action NAT Src Iface lan Src Net lannet Dest Iface wan Dest Net all-nets Parameters http The routing table consequently contains the following default route: Interface wan Destination all-nets Gateway 195.66.77.1 Metric 10 Monitoring Off Now a secondary route is added over a backup DSL connection and Route Monitoring is enabled for this. The updated routing table will look like this: Route # 1 2 Interface wan dsl Destination all-nets all-nets Gateway 195.66.77.1 193.54.68.1 Metric 10 20 Monitoring On Off Notice that Route Monitoring is enabled for the first route but not the backup, failover route. As long as the preferred wan route is healthy, everything will work as expected. Route Monitoring will also be functioning, so the secondary route will be enabled if the wan route should fail. There are, however, some problems with this setup: if a route failover occurs, the default route will then use the dsl interface. When a new HTTP connection is then established from the intnet network, a route lookup will be made resulting in a destination interface of dsl. The IP rules will then be evaluated, but the original NAT rule assumes the destination interface to be wan so the new connection will be dropped by the rule set. In addition, any existing connections matching the NAT rule will also be dropped as a result of the 176