How do you deal with Service Route and MGT port redundancy?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

How do you deal with Service Route and MGT port redundancy?

L3 Networker

We had an outage that took out a switch, and the PA management port is connected to that switch. I was unable to access the UI or CLI, and VPN was unable to authenticate via LDAP. I found the issue was that all the Service Routes were set to default using the MGT port.

 

After looking through the settings, I see that I can assign a Management Profile to multiple interfaces, which would allow me to access the UI/CLI if the management port goes down. But that does not include Service Routes, which can only be assigned to a single interface- either the MGT port, or a another interface.

 

Is it possible to make service routes redundant? Maybe something like a PBF rule for service routes?

 

1 accepted solution

Accepted Solutions

L3 Networker

Make the interface you want to attach the service route to a redundant (aggregate ethernet) interface.

View solution in original post

4 REPLIES 4

Cyber Elite
Cyber Elite

Hello,

You have it correct for the managment interface. As for the service route, there is not one. Depeding on where the failure is, a HA pair might work.

 

But it depends.

 

Regards,

Hi @Maxstr,

 

Unfortunately that is correct, service routes can be configured only through one interface.

 

However a workaround would be to configure service route based on destination. Take for example LDAP:

- You must leave the service route for LDAP on default

- On tab destinations configure two or more LDAP servers. Each server can be assignd with different interface

The catch here is that firewall will use the IP from the interface as source address when trying to connect to LDAP, BUT it will always perform route lookup first to check how to get to the LDAP server.

 

 

L3 Networker

Make the interface you want to attach the service route to a redundant (aggregate ethernet) interface.

To add to TSilverLine - 

 

Aggregate ethernet going to two different switches (stacked, MC-LAG, etc)... 😃

  • 1 accepted solution
  • 4644 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!