How do you deal with Service Route and MGT port redundancy?

Reply
L3 Networker

How do you deal with Service Route and MGT port redundancy?

We had an outage that took out a switch, and the PA management port is connected to that switch. I was unable to access the UI or CLI, and VPN was unable to authenticate via LDAP. I found the issue was that all the Service Routes were set to default using the MGT port.

 

After looking through the settings, I see that I can assign a Management Profile to multiple interfaces, which would allow me to access the UI/CLI if the management port goes down. But that does not include Service Routes, which can only be assigned to a single interface- either the MGT port, or a another interface.

 

Is it possible to make service routes redundant? Maybe something like a PBF rule for service routes?

 

L7 Applicator

Re: How do you deal with Service Route and MGT port redundancy?

Hello,

You have it correct for the managment interface. As for the service route, there is not one. Depeding on where the failure is, a HA pair might work.

 

But it depends.

 

Regards,

L4 Transporter

Re: How do you deal with Service Route and MGT port redundancy?

Hi @Maxstr,

 

Unfortunately that is correct, service routes can be configured only through one interface.

 

However a workaround would be to configure service route based on destination. Take for example LDAP:

- You must leave the service route for LDAP on default

- On tab destinations configure two or more LDAP servers. Each server can be assignd with different interface

The catch here is that firewall will use the IP from the interface as source address when trying to connect to LDAP, BUT it will always perform route lookup first to check how to get to the LDAP server.

 

 

L3 Networker

Re: How do you deal with Service Route and MGT port redundancy?

Make the interface you want to attach the service route to a redundant (aggregate ethernet) interface.


*Please like or mark as solution if the answer is helpful!*
L4 Transporter

Re: How do you deal with Service Route and MGT port redundancy?

To add to TSilverLine - 

 

Aggregate ethernet going to two different switches (stacked, MC-LAG, etc)... =)

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!