D-Link NetDefendOS

be made resulting in a destination interface of dsl. The IP rules will then be evaluated, but the
original NAT rule assumes the destination interface to be wan so the new connection will be
dropped by the rule set.
In addition, any existing connections matching the NAT rule will also be dropped as a result of
the change in the destination interface. Clearly, this is undesirable.
To overcome this issue, potential destination interfaces should be grouped together into an
Interface Group and the Security/Transport Equivalent option should be enabled for the group
so that connections can be moved between interfaces. The interface group is then used as the
destination interface when setting policies. For more information on interface groups, see
Section 3.4.10, “Interface Groups”.
Gratuitous ARP Generation
By default NetDefendOS generates a gratuitous ARP request when a route failover occurs. The
reason for this is to notify surrounding systems that there has been a route change. This behavior
can be controlled by the advanced setting Gratuitous ARP on Fail.
4.2.4. Host Monitoring for Route Failover
Overview
To provide a more flexible and configurable way to monitor the integrity of routes, NetDefendOS
provides the additional capability to perform Host Monitoring. This feature means that one or
more external host systems can be routinely polled to check that a particular route is available.
The advantages of host monitoring are twofold:
• In a complex network topology it is more reliable to check accessibility to external hosts. Just
monitoring a link to a local switch may not indicate a problem in another part of the internal
network.
• Host monitoring can be used to help in setting the acceptable Quality of Service level of
Internet response times. Internet access may be functioning but it may be desirable to
instigate route failover if response latency times become unacceptable using the existing
route.
Enabling Host Monitoring
Host monitoring can be enabled as a property of a Route object and a single route can have
multiple hosts associated with it for monitoring. Multiple hosts can provide a higher certainty
that any network problem resides in the local network rather than because one remote host itself
is down.
In association with host monitoring there are two numerical parameters for a route:
Grace Period This is the period of time after startup or after
reconfiguration of the NetDefend Firewall which
NetDefendOS will wait before starting monitoring. This
waiting period allows time for all network links to initialize
once the firewall comes online.
Minimum Number of Hosts
Available
This is the minimum number of hosts that must be
considered to be accessible before the route is deemed to
have failed. The criteria for host accessibility are described
below.
Chapter 4: Routing
299