Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 14 replies
  • Answers 3 answers
  • Subscribers 30 subscribers
  • Views 16261 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Active sessions don't fail back when primary gateway restored

Brian Heaton

Hardware: XG-125

Firmware version: 17.06

----------------------------

Configuration:

- Gateway 1 - Active, weight 1, connected to a low latency terrestrial connection

- Gateway 2 - Backup, inherit weight from primary, connected to a satellite connection

- Firewall Rule - Primary gateway: Gateway 1 - Backup Gateway: Gateway 2

 

Behavior:

Failover -  Works beautifully. When Gateway 1 fails (pings fail) traffic flips over to Gateway 2. 

 

Failback - When Gateway 1 comes back up, network flows that either failed over to Gateway 2 - or ere already active on Gateway 2 when Gateway 1 came back up DOES NOT failback to Gateway 1.

This is problematic for us because long-lived high-bandwidth flows remain on the satellite network instead of flipping back to the low latency terrestrial connection. Suggestions on how to resolve this and cause flows to failback properly to the primary gateway?



This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to Joel Peeples

    As far as i know, this is works as designed. 

    Basically XG is using and holding active sessions via Conntrack to one WAN Interface. If there would be a fallback to the failure WAN interface, it would cause a conntrack / stateful firewall missmatch and most of the services in the internet would go crazy. 

    You need to setup a new connection in order to get the Connections up and running. 

    There is something called tcp handshake. https://en.wikipedia.org/wiki/Transmission_Control_Protocol#Connection_establishment

    So if you perform the Handshake with WAN2 (as failover) and want to switch to WAN1 after failback, it would break the handshake because you are using another IP and not the original source ip of WAN2. So XG is holding the connection on WAN2 and build up all new connections with WAN1. 

Children