D-Link NetDefend DFL-210 User Manual page 132

4.2.3. Route Failover
second failover route. The first two routes would have Route Monitoring enabled in the routing
table but the last one (with the highest Metric) would not since it has no route to failover to.
Failover Processing
Whenever monitoring determines that a route is not available, NetDefendOS will mark the route as
disabled and instigate Route Failover for existing and new connections. For already established
connections, a route lookup will be performed to find the next best matching route and the
connections will then switch to using the new route. For new connections, route lookup will ignore
disabled routes and the next best matching route will be used instead.
The table below defines two default routes, both having all-nets as the destination, but using two
different gateways. The first, primary route has the lowest Metric and also has Route Monitoring
enabled. Route Monitoring for the second, alternate route is not meaningful since it has no failover
route.
Route #
1
2
When a new connection is about to be established to a host on the Internet, a route lookup will result
in the route that has the lowest Metric being chosen. If the primary WAN router should then fail,
this will be detected by NetDefendOS, and the first route will be disabled. As a consequence, a new
route lookup will be performed and the second route will be selected with the first one being marked
as disabled.
Re-enabling Routes
Even if a route has been disabled, NetDefendOS will continue to check the status of that route.
Should the route become available again, it will be re-enabled and existing connections will
automatically be transferred back to it.
Route Interface Grouping
When using route monitoring, it is important to check if a failover to another route will cause the
routing interface to be changed. If this could happen, it is necessary to take some precautionary steps
to ensure that policies and existing connections will be maintained.
To illustrate the problem, consider the following configuration:
First, there is one IP rule that will NAT all HTTP traffic destined for the Internet through the wan
interface:
#
1
The routing table consequently contains the following default route:
Route #
1
Now a secondary route is added over a backup DSL connection and Route Monitoring is enabled for
this. The updated routing table will look like this:
Route #
1
2
Notice that Route Monitoring is enabled for the first route but not the backup, failover route.
Interface Destination
wan all-nets
wan all-nets
Action Src Iface
NAT lan
Interface Destination
wan all-nets
Interface Destination
wan all-nets
dsl all-nets
Gateway
195.66.77.1
193.54.68.1
Src Net Dest Iface
lannet wan
Gateway
195.66.77.1
Gateway
195.66.77.1
193.54.68.1
132
Chapter 4. Routing
Metric Monitoring
10 On
20 Off
Dest Net Parameters
all-nets http
Metric Monitoring
10 Off
Metric Monitoring
10 On
20 Off