topic Re: Monitoring profile troubles - Dual ISP in General Topics

Monitoring profile troubles - Dual ISP

treese — Fri, 24 Apr 2015 20:05:35 GMT

I got a TAC with PA opened for this one but wanted to ask the community if you've experience this one. The problem is when the PBF kicks in (disabled primary circuit) the primary circuit traffic immediately fails over to the backup ISP. I've adjusted the fail-over monitoring profile interval's and the threshold but neither seem to have an affect. Its basically working like a floating static route which I'm wanting to avoid. The plan is when the primary circuit is unavailable to wait and fail-over at a specified time - 100 sec interval would be fine. This is how I understand it:

"A monitoring profile allows the user to specify the threshold number of heartbeats to determine whether the IP address is reachable" then take the action specified - wait to recover or fail-over.

Anything I'm missing or suggestions?

Thank you,

Re: Monitoring profile troubles - Dual ISP

treese — Tue, 28 Jul 2015 18:06:50 GMT

Any new info on this one?

Re: Monitoring profile troubles - Dual ISP

gwesson — Wed, 17 Feb 2016 05:18:48 GMT

How are you doing the failover testing? Are you pulling the link or killing the interface on the connected switch? If that's how you're testing, the failover will be immediate because the link is effectively dead. There's no hold timer because the routes are immediately removed from the route table.

If you're monitoriting a remote IP, try denying that IP with an upstream firewall or ACL, or by blocking your primary ISPs public interface address from your monitor server. This should induce the failure in a way that would mimic an outage on the ISP side without actually updating the route table immediately.

If you are already doing it the 2nd way above, then I would expect it to work using the hold timer you've configured. Anything other than that would probably be best troubleshot with a support case. You can also take a look at your routing tables with "show routing route" on the firewall's CLI.

Cheers,

Greg