Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 281
  • Last Modified:

Failover & LB

Hi

I use a TZ215 with two ISP connection. I want to use them as round robin but I want that one of them be always the master because I have a fix IP on it.

What is the best setup to use?

Thanks
0
jpmoreau
Asked:
jpmoreau
1 Solution
 
Blue Street TechLast KnightsCommented:
Hi jpmoreau,

In order to do that just put the primary IP at the top...with Round Robin it works in priority status. So in your case traffic will flow will flip back and forth between your Primary and Secondary. Literally, if you refresh a web page the first time will be on the Primary and on the next refresh will be on the Secondary side. It sounds like you actually want to just have Basic Active/Passive Failover rather than Round Robin if you want the Primary to truly act as the Primary connection and the Secondary to act only if the Primary fails.

Here is a step-by-step on how to properly setup this: https://www.fuzeqna.com/sonicwallkb/ext/kbdetail.aspx?kbid=7828

Let me know if you have any questions!
0
 
Jason PalmerOwnerCommented:
By TZ215, I assume you mean Sonicwall.

Your configuration does not really make any sense.  Sonicwall's, particularly the TZ series provide Fail-Over (Active-Passive) and not Active-Active configurations.

See the specification/overview page here:

http://www.sonicwall.com/us/en/products/TZ_215.html

If you have two TZ 215 units, then one unit is always primary and the other physical unit is always in Stand-by Mode.

Given that you have only one Static IP from one specific ISP, you have some choices depending on the speed differential between the two ISP connections and the types of services you are trying to configure.

For example, many of my customers have a static IP for their Mail Services on a T1 or Ethernet over Copper legacy or slower connection that has a real SLA (Service Level Agreement) then a significantly less expensive but much faster Cable/FiOS broadband connection with a Dynamic IP which is used for high speed web browsing and file transfer, or streaming video, music, etc.  In this case, we create Sonicwall Rules to Route all mail services over the Primary interface and all FTP/HTTP traffic over the secondary dynamic IP interface. We also configure a dynamic DNS service, such as dyndns.org , on the dynamic IP broadband connection and set a lower priority MX record to that CNAME.

Should the primary connection go down, mail will arrive via the dynamic DNS entry to the lower priority MX record.

If you are using the SSL-VPN or any type of VPN/dedicated services, just give users two different URL's to access:  i.e.  vpn.domain.com and vpn2.domain.com as the fall-back.

If you are trying to host a web site internally with two carriers having one static and one dynamic address, this is much harder to do because of the way that larger providers cache DNS entries.  So, unless you use a rock solid third party DNS provider like dyn.com or ultraDNS.com that use unicast, where DNS updates are virtually instantaneous, it could take hours or even a day for most ISP's and the likes of Verizon or Comcast or Cablevision to properly route the CNAME to the Fail-over A Record.

To be clear:  There are two parts to your solution depending on the services you are trying to keep "up" in the event of primary ISP failure.  If there are no internal services that are accessible from the outside, none of this matters.  Just configure the TZ 215 in straight fail-over mode for all services.    If there are internal services that need access from the outside, i.e. mail or web hosting, then it is critical that you create proper dynamic DNS host names and work with a DNS provider that can update entries globally quickly using some form of unicast technology.  Most regular ISP's just use BIND and this will leave you with a period of down time unless you have explicit control of the TTL (Time to Live) of your DNS Records.

Hope this helps,

Jason.
0
 
jpmoreauAuthor Commented:
Will check this in two weeks
0
Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

 
Blue Street TechLast KnightsCommented:
Sounds good...keep me posted!
0
 
Blue Street TechLast KnightsCommented:
I'm glad I could help...thanks for the points!
0
 
fluidequipmentCommented:
"For example, many of my customers have a static IP for their Mail Services on a T1 or Ethernet over Copper legacy or slower connection that has a real SLA (Service Level Agreement) then a significantly less expensive but much faster Cable/FiOS broadband connection with a Dynamic IP which is used for high speed web browsing and file transfer, or streaming video, music, etc.  In this case, we create Sonicwall Rules to Route all mail services over the Primary interface and all FTP/HTTP traffic over the secondary dynamic IP interface."

This is exactly what I am looking to do on my TZ215 device. Would you be able to elaborate further on how to specifically and correctly create this static route for mail? Thanks!

Also, I am having trouble deciding on what failover/lb mode to use. I currently have it set to basic failover, but does this mean that my secondary WAN is on standby completely until the WAN1 fails? To the point that I cant even route traffic through it with static routes?
0
 
Blue Street TechLast KnightsCommented:
@fluidequipment - Sure go ahead and ask a new Question...and we'd love to take care of this for you!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

NEW Internet Security Report Now Available!

WatchGuard’s Threat Lab is a group of dedicated threat researchers committed to helping you stay ahead of the bad guys by providing in-depth analysis of the top security threats to your network.  Check out this quarters report on the threats that shook the industry in Q4 2017.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now