Testing the quality of the main link

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Testing the quality of the main link

L0 Member

Hello,

The ISP had a failure on its side, which involved slow connection, which made it difficult for people inside the company and those working on VPN to work. We have a backup connection that switches in the event of a failure of the main connection. Is it possible to introduce a mechanism that tests the throughput of the main connection and, in the event of a drop in speed and quality, switches to the second one.

Additionally, can I configure one portal in Global Protec that will refer to two addresses? So that when it is not possible to connect to the first address, it will try to connect to the second one?

1 REPLY 1

Cyber Elite
Cyber Elite

@D.Drzyzga,

Slow connections isn't something that the firewall can really monitor by itself. You would need an outside process such as a monitoring script(s) that can monitor both connections and that could then either alert you of a potential issue, or automatically failover traffic via the API if you wish to bring things that far. The firewall can monitor for an entire failure through path monitoring, but that external step is needed to true performance monitoring.

 

As for your GlobalProtect question, the firewall itself can't push out an agent configuration that has two addresses tied to a single portal address. You would generally utilize something like a load-balancer or dynamic DNS to perform something like that so you could quickly migrate traffic to that portal address to your other address.

Keep in mind that portal caching is a thing, so if you have multiple gateways configured (one on each connection) your portal doesn't really need to be active for existing endpoints. The GlobalProtect agent will use the cached portal configuration when the portal is not reachable, and if you have both of your gateways included it will connect to the gateway that is online. Keep in mind that in the scenario that you're describing where you don't have a full outage, you'll need to manually down the portal/gateway to get this to behave properly. A slow connection is one of those things that kind of requires manual interaction on your end more than an actual failure would, as you want to identify that and just bring that bad connection down.

  • 174 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!