topic Dual ISP failover - stuck UDP sessions in General Topics

Dual ISP failover - stuck UDP sessions

bfitzpatrick — Thu, 08 Dec 2016 21:34:41 GMT

Hi, I've configured Dual ISP failover using a PBF and everything seems to failover from ISP1 to ISP2 just fine. My issue is after we have failed over to ISP2 and ISP1 comes back online, not all traffic flips back to ISP1.

UDP sessions for devices that have a keep alive or heart beat seem to be the most problematic. Currently the SIP/RTP traffic from my phones seems to be causing the most issues. How can i get the Palo Alto to kill those sessions once the primary ISP comes back online? My ISP2 is a metered LTE connection and I'd like to save as much data as possible. When i look at the sessions in the CLI, the sessions that are on ISP2 still get renewed even when ISP1 is online and they never end unless i clear the sessions manually or i pull the network cable out of the LTE router.

Any help would be appreciated!

Re: Dual ISP failover - stuck UDP sessions

BPry — Thu, 08 Dec 2016 21:48:12 GMT

I don't think you are going to be able to do anything but clear them out manually. The session is going to stay on the route until it ages-out or is cleared, it won't go back through the process of deciding a path because it already has one open.

Re: Dual ISP failover - stuck UDP sessions

santonic — Mon, 12 Dec 2016 14:28:48 GMT

Write a script (in your prefered programming language) which:

- checks ISP1 periodically,

- set a trigger to detect if ISP1 goes down,

- after ISP1 is down it waits till it comes back up again,

- when ISP1 comes back it uses PA XML API to disable ISP2 (brings interface down) for a short while

I know it's not elegant and it takes some careful planning on conditions, but it could work.

Re: Dual ISP failover - stuck UDP sessions

BPry — Mon, 12 Dec 2016 15:00:50 GMT

Sadly @santonic probably has the most 'elegent' solution to this issue as long as you are comfortable enough to script something like this.

Re: Dual ISP failover - stuck UDP sessions

ozheng — Mon, 21 Dec 2020 07:58:21 GMT

You'll find your solution in the KB below.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBmqCAG

Re: Dual ISP failover - stuck UDP sessions

trjohnson — Tue, 12 Dec 2023 18:35:44 GMT

Hi all, checking in to see if an automated solution was identified for this scenario or if you simply decided to manually clear these sessions when failover over to another link?

Re: Dual ISP failover - stuck UDP sessions

ozheng — Thu, 14 Dec 2023 07:32:45 GMT

Hello Trjohnson,

You open the KB I shared, and you try it.

Regards

Olivier