change in the destination interface. Clearly, this is undesirable.
To overcome this issue, potential destination interfaces should be grouped together into an Interface
Group and the Security/Transport Equivalent flag should be enabled for the Group. The Interface
Group is then used as the Destination Interface when setting policies. For more information on
groups, see Section 3.4.6, “Interface Groups”.
Gratuitous ARP Generation
By default NetDefendOS generates a gratuitous ARP request when a route failover occurs. The
reason for this is to notify surrounding systems that there has been a route change. This behavior can
be controlled by the advanced setting Gratuitous ARP on Fail.
4.2.4. Host Monitoring for Route Failover
Overview
To provide a more flexible and configurable way to monitor the integrity of routes, NetDefendOS
provides the additional capability to perform Host Monitoring. This feature means that one or more
external host systems can be routinely polled to check that a particular route is available.
The advantages of Host Monitoring are twofold:
• In a complex network topology it is more reliable to check accessibility to external hosts. Just
monitoring a link to a local switch may not indicate a problem in another part of the internal
network.
• Host monitoring can be used to help in setting the acceptable Quality of Service level of Internet
response times. Internet access may be functioning but it may be desirable to instigate route
failover if response latency times become unacceptable using the existing route.
Enabling Host Monitoring
As part of Route Properties Host Monitoring can be enabled and a single route can have multiple
hosts associated with it for monitoring. Multiple hosts can provide a higher certainty that any
network problem resides in the local network rather than because one remote host itself is down.
In association with Host Monitoring there are two numerical parameters for a route:
Grace Period
This is the period of time after startup or after reconfiguration
of the NetDefend Firewall which NetDefendOS will wait
before starting Route Monitoring. This waiting period allows
time for all network links to initialize once the firewall comes
online.
Minimum Number of Hosts
Available
This is the minimum number of hosts that must be considered
to be accessible before the route is deemed to have failed. The
criteria for host accessibility are described below.
Specifying Hosts
For each host specified for host monitoring there are a number of property parameters that should be
set:
• Method
4.2.4. Host Monitoring for Route
Failover
Chapter 4. Routing
177
To Next Page
Loading...
