WAN Link Management Failover issue

Question

Hi, 
 
 I'm testing the new release version of Sophos XG V16 and now currently stuck in WAN Link Management. It seems that Failover functionality is not working. I have 2 WAN links and currently testing a failover scenario but it does not work. 
 Using the default: NOT WORKING

Name

IP Address

Interface

Type

Activate on Failure of

Weight

NAT Policy

Status

Manage

GW1

192.168.2.1

PortE - 192.168.2.3/255.255.255.0

Active

N/A

100

MASQ

GW2

192.168.1.1

PortB - 192.168.1.100/255.255.255.0

Active

N/A 
 
 100 
 
 MASQ

Using Active/Standby: NOT WORKING

Name

IP Address

Interface

Type

Activate on Failure of

Weight

NAT Policy

Status

Manage

GW1

192.168.2.1

PortE - 192.168.2.3/255.255.255.0

Active

N/A

100

MASQ

GW2

192.168.1.1

PortB - 192.168.1.100/255.255.255.0 
 
 Backu 
 
 GW1 
 
 100 
 
 MASQ

Also setting the Firewall Policy NAT and Routing to have Primary Gateway and Secondary Gateway or even setting it to None, Still NO Failover. 
 
 Any reasons why? Im using HW-SFOS_16.01.1.SF300-202 upgrade on a CR500iNG-XP (SFOS 16.01.1) 
 
 Tnx

varunparikh · Accepted Answer

Hello Mike, 
 Please see the configuration screenshots from my lab. (Network > WAN Link Manager) 
 1. Active gateway failover rules 
 
 2. Backup gateway configuration 
 
 3. Firewall rule configuration

Please test with these settings and I am hopeful that it will work for you as expected. 
 Regards,

varunparikh · Answer

Could you please screenshot the failover conditions and show me? 
 Please also check your DM.

Aditya Patel · Answer

HI Mike, 
 Could you change the default Gateway condition to Ping 8.8.8.8 on both internet gateways. Also reduce the failover timeout to 20 seconds. 
 Thanks 
 Aditya Patel

MikeDe Leon · Answer

Hi varunparikh , 
 
 Thnx for your help. You're correct that it's the LAN > WAN rule. There's a mixed up in my firewall rule as the destination also contains other zone other than the WAN. For the WAN loadbalancing and failover works, the destination Zone should only be "WAN". It's all working now. 
 
 Thank you for your help! 
 
 Regards, 
 
 Mike

Aditya Patel · Answer

Hi Vikram , 
 A static route is not needed in this scenario. 
 Technically the option is provided if there 2 or more WAN interface configured. The default is set to load balance, but it is up to the user to choose the primary and secondary if needed to alter the traffic path for a set of rules. 
 e.g. 
 As per the gateway, GW1 is active and GW2 is the backup. 
 As per the rule, the default gateway setup will follow the GW1 as primary and GW2 as secondary. In some cases, the administrator wants to divert some high profile traffic to another gateway and he could set manually the primary as GW2 and secondary as Load balance or GW1. 
 As for the Static route, it is not needed the kernel shall devise the route for you as per the rule and fail-over gateway setup. The static route is only used when you wish to overide the kernel route.