D-Link NetDefendOS User Manual page 298

Network security firewall

Hide thumbs Also See for NetDefendOS:

Table of Contents

The table below defines two default routes, both having all-nets as the destination, but using two

different gateways. The first, primary route has the lowest metric and also has route monitoring

enabled. Route monitoring for the second, alternate route is not meaningful since it has no

failover route.

When a new connection is about to be established to a host on the Internet, a route lookup will

result in the route that has the lowest metric being chosen. If the primary WAN router should

then fail, this will be detected by NetDefendOS, and the first route will be disabled. As a

consequence, a new route lookup will be performed and the second route will be selected with

the first one being marked as disabled.

Re-enabling Routes

Even if a route has been disabled, NetDefendOS will continue to check the status of that route.

Should the route become available again, it will be re-enabled and existing connections will

automatically be transferred back to it.

Route Interface Grouping

When using route monitoring, it is important to check if a failover to another route will cause the

routing interface to be changed. If this could happen, it is necessary to take some precautionary

steps to ensure that policies and existing connections will be maintained.

To illustrate the problem, consider the following configuration:

Firstly, there is one IP rule that will NAT all HTTP traffic destined for the Internet through the wan

The routing table consequently contains the following default route:

Now a secondary route is added over a backup DSL connection and route monitoring is enabled

for this. The updated routing table will look like this:

Notice that route monitoring is enabled for the first route but not the backup, failover route.

As long as the preferred wan route is healthy, everything will work as expected. route

monitoring will also be functioning, so the secondary route will be enabled if the wan route

should fail.

However, there are some problems with this setup: if a route failover occurs, the default route

will then use the dsl interface. When a new HTTP connection is established, a route lookup will

Chapter 4: Routing

Show Quick Links

Table of Contents

Troubleshooting