D-Link 800 - DFL 800 - Security Appliance, User Manual

Page: 133 / 469

As long as the preferred wan route is healthy, everything will work as expected. Route Monitoring
will also be functioning, so the secondary route will be enabled if the wan route should fail.
There are, however, some problems with this setup: if a route failover occurs, the default route will
then use the dsl interface. When a new HTTP connection is then established from the intnet
network, a route lookup will be made resulting in a destination interface of dsl. The IP rules will
then be evaluated, but the original NAT rule assumes the destination interface to be wan so the new
connection will be dropped by the rule set.
In addition, any existing connections matching the NAT rule will also be dropped as a result of the
change in the destination interface. Clearly, this is undesirable.
To overcome this issue, potential destination interfaces should be grouped together into an Interface
Group and the Security/Transport Equivalent flag should be enabled for the Group. The Interface
Group is then used as the Destination Interface when setting policies. For more information on
groups, see Section 3.3.6, “Interface Groups”.
Gratuitous ARP Generation
By default NetDefendOS generates a gratuitous ARP request when a route failover occurs. The
reason for this is to notify surrounding systems that there has been a route change. This behavior can
be controlled by the advanced setting Gratuitous ARP on Fail.
4.2.4. Host Monitoring for Route Failover
Overview
To provide a more flexible and configurable way to monitor the integrity of routes, NetDefendOS
provides the additional capability to perform Host Monitoring. This feature means that one or more
external host systems can be routinely polled to check that a particular route is available.
The advantages of Host Monitoring are twofold:
• In a complex network topology it is more reliable to check accessibility to external hosts. Just
monitoring a link to a local switch may not indicate a problem in another part of the internal
network.
• Host monitoring can be used to help in setting the acceptable Quality of Service level of Internet
response times. Internet access may be functioning but it may be desirable to instigate route
failover if response latency times become unacceptable using the existing route.
Enabling Host Monitoring
As part of Route Properties Host Monitoring can be enabled and a single route can have multiple
hosts associated with it for monitoring. Multiple hosts can provide a higher certainty that any
network problem resides in the local network rather than because one remote host itself is down.
In association with Host Monitoring there are two numerical parameters for a route:
Grace Period This is the period of time after startup or after reconfiguration
of the D-Link Firewall which NetDefendOS will wait before
starting Route Monitoring. This waiting period allows time
for all network links to initialize once the firewall comes
online.
Minimum Number of Hosts
Available This is the minimum number of hosts that must be considered
to be accessible before the route is deemed to have failed. The
criteria for host accessibility are described below.
4.2.4. Host Monitoring for Route
Failover Chapter 4. Routing
133