Host Monitoring For Route Failover - D-Link NetDefend DFL-210 User Manual

4.2.4. Host Monitoring for Route
Failover
Even if a route has been disabled, NetDefendOS will continue to check the status of that route.
Should the route become available again, it will be re-enabled and existing connections will
automatically be transferred back to it.
Route Interface Grouping
When using route monitoring, it is important to check if a failover to another route will cause the
routing interface to be changed. If this could happen, it is necessary to take some precautionary steps
to ensure that policies and existing connections will be maintained.
To illustrate the problem, consider the following configuration:
Firstly, there is one IP rule that will NAT all HTTP traffic destined for the Internet through the wan
interface:
Action
NAT
The routing table consequently contains the following default route:
Interface
wan
Now a secondary route is added over a backup DSL connection and Route Monitoring is enabled for
this. The updated routing table will look like this:
Route #
1
2
Notice that Route Monitoring is enabled for the first route but not the backup, failover route.
As long as the preferred wan route is healthy, everything will work as expected. Route Monitoring
will also be functioning, so the secondary route will be enabled if the wan route should fail.
There are, however, some problems with this setup: if a route failover occurs, the default route will
then use the dsl interface. When a new HTTP connection is then established from the intnet
network, a route lookup will be made resulting in a destination interface of dsl. The IP rules will
then be evaluated, but the original NAT rule assumes the destination interface to be wan so the new
connection will be dropped by the rule set.
In addition, any existing connections matching the NAT rule will also be dropped as a result of the
change in the destination interface. Clearly, this is undesirable.
To overcome this issue, potential destination interfaces should be grouped together into an Interface
Group and the Security/Transport Equivalent flag should be enabled for the Group. The Interface
Group is then used as the Destination Interface when setting policies. For more information on
groups, see Section 3.3.6, "Interface Groups".
Gratuitous ARP Generation
By default NetDefendOS generates a gratuitous ARP request when a route failover occurs. The
reason for this is to notify surrounding systems that there has been a route change. This behavior can
be controlled by the advanced setting Gratuitous ARP on Fail.

4.2.4. Host Monitoring for Route Failover

Overview
To provide a more flexible and configurable way to monitor the integrity of routes, NetDefendOS
Src Iface Src Net
lan lannet
Destination
all-nets 195.66.77.1
Interface Destination
wan all-nets
dsl all-nets
142
Dest Iface
wan
Gateway Metric
10
Gateway
195.66.77.1
193.54.68.1
Chapter 4. Routing
Dest Net Parameters
all-nets http
Monitoring
Off
Metric Monitoring
10 On
20 Off