Failover WAN not failing over

Hi M8ey

Try to keep the WAN link load balance in the Firewall rule and see if that works. It's interesting that traffic does not pass through the Port8 when Port3 is down. Have you created any additional static routes or advanced firewall rules in the backend?

Jaydeep said:

WAN link load balance in the Firewall rule and see if that works.

Hey Jaydeep - yes we tried that as well. Sophos support even created a rule and tried all they could.

I strongly believe its an issue with two PPPoE connections and how the XG handles a change such as failover. This XG used to have a Static and a PPPoE and it has failed over fine.

A few updates and a change to WAN and no failover.

Another Level 2 session booked for Monday night

Hi,

the issue being that while WAN link manager causes fail overs, it does not cause a DHCP (PPPoE) refresh on the failed link and if the secondary link has failed at some stage, the failover process fails to connect.

This should be relatively easy to prove. To cheap modem/routers that can handle PPPoE and have their NAT function disabled. Set one up on each link and monitor for a couple of days. Try causing link to fail eg disconnect the PPPoE interface cable, then reconnect it, then do the same with the other modem PPPoE interface cable.

Ian

rfcat_vk said:

the issue being that while WAN link manager causes fail overs, it does not cause a DHCP (PPPoE) refresh on the failed link and if the secondary link has failed at some stage, the failover process fails to connect.

Might have something to do with it - however the XG does failover to the secondary link and its Active. my RED device reconnects to the failover WAN fine and from the XG you can ping / resolve the internet.

But anything on the LAN side of the XG gets a Firewall VIOLATION error - Sophos Support couldnt work it out and we set up specific rules to force the traffic via the failover WAN but it just got blocked by the Firewall.

Left the Support guy scratching his head.

Get them to do an edit and save of the offending interface (no changes).

Ian

Level 2 Engineer jumped in last night and ran many logs and tests

Admitted it has him stumpted also.....

Its really looks like the NAT doesnt kick in bit the connection is up etc.

Now we wait for them to check the logs

Another Hot date with a Sophos Engineer in a romantic Comms room environment tonight at 7.30pm :-)

The Menu tonight is additional Log taking:

"We need to check with generating the TCP  traffic at the time when failover happens instead of icmp 

Also we may need to collect some additional debug logs in order to understand the issue in better manner"

It is a very weird issue though. 

I know it worked when I had Static / PPPoE - I wonder if now I have PPPoE / PPPoE it gets stuck / confused.

Anyways the investigation continues.....

Keep up the good work, we might see a fix for this issue.

This morning I took my XG offline while trying to update my UTM, the XG was offline for about 20 minutes and when reconnected work not pass traffic. Also was very slow to GUI login attempts. The WAN link showed failure even though I received messages indicating that the link was restored.

I had to edit the WAN interface, save it before the XG requested a new IP address from the ISP.

Ian

I still think we have different issues.

My Failover PPPoE is connected and incoming connectivity is available  i.e the RED reconnects to the backup fine.

My issue is more from LAN - WAN - no traffic passes and I get a VIOLATION error. The FW rules that are required are correct but it wont pass traffic like the NAT is broken

That describes my issue exactly.

Ian