Failover & LB

By TZ215, I assume you mean Sonicwall.

Your configuration does not really make any sense.  Sonicwall's, particularly the TZ series provide Fail-Over (Active-Passive) and not Active-Active configurations.

See the specification/overview page here:

http://www.sonicwall.com/us/en/products/TZ_215.html

If you have two TZ 215 units, then one unit is always primary and the other physical unit is always in Stand-by Mode.

Given that you have only one Static IP from one specific ISP, you have some choices depending on the speed differential between the two ISP connections and the types of services you are trying to configure.

For example, many of my customers have a static IP for their Mail Services on a T1 or Ethernet over Copper legacy or slower connection that has a real SLA (Service Level Agreement) then a significantly less expensive but much faster Cable/FiOS broadband connection with a Dynamic IP which is used for high speed web browsing and file transfer, or streaming video, music, etc.  In this case, we create Sonicwall Rules to Route all mail services over the Primary interface and all FTP/HTTP traffic over the secondary dynamic IP interface. We also configure a dynamic DNS service, such as dyndns.org , on the dynamic IP broadband connection and set a lower priority MX record to that CNAME.

Should the primary connection go down, mail will arrive via the dynamic DNS entry to the lower priority MX record.

If you are using the SSL-VPN or any type of VPN/dedicated services, just give users two different URL's to access:  i.e.  vpn.domain.com and vpn2.domain.com as the fall-back.

If you are trying to host a web site internally with two carriers having one static and one dynamic address, this is much harder to do because of the way that larger providers cache DNS entries.  So, unless you use a rock solid third party DNS provider like dyn.com or ultraDNS.com that use unicast, where DNS updates are virtually instantaneous, it could take hours or even a day for most ISP's and the likes of Verizon or Comcast or Cablevision to properly route the CNAME to the Fail-over A Record.

To be clear:  There are two parts to your solution depending on the services you are trying to keep "up" in the event of primary ISP failure.  If there are no internal services that are accessible from the outside, none of this matters.  Just configure the TZ 215 in straight fail-over mode for all services.    If there are internal services that need access from the outside, i.e. mail or web hosting, then it is critical that you create proper dynamic DNS host names and work with a DNS provider that can update entries globally quickly using some form of unicast technology.  Most regular ISP's just use BIND and this will leave you with a period of down time unless you have explicit control of the TTL (Time to Live) of your DNS Records.

Hope this helps,

Jason.

Will check this in two weeks

Sounds good...keep me posted!

I'm glad I could help...thanks for the points!

"For example, many of my customers have a static IP for their Mail Services on a T1 or Ethernet over Copper legacy or slower connection that has a real SLA (Service Level Agreement) then a significantly less expensive but much faster Cable/FiOS broadband connection with a Dynamic IP which is used for high speed web browsing and file transfer, or streaming video, music, etc.  In this case, we create Sonicwall Rules to Route all mail services over the Primary interface and all FTP/HTTP traffic over the secondary dynamic IP interface."

This is exactly what I am looking to do on my TZ215 device. Would you be able to elaborate further on how to specifically and correctly create this static route for mail? Thanks!

Also, I am having trouble deciding on what failover/lb mode to use. I currently have it set to basic failover, but does this mean that my secondary WAN is on standby completely until the WAN1 fails? To the point that I cant even route traffic through it with static routes?

@fluidequipment - Sure go ahead and ask a new Question...and we'd love to take care of this for you!