SDWAN Passive monitoring

[BusinessUser]

If you use passive monitoring for SDWAN, how is the firewall going to detect the link is down assuming that there are zero users?

[asoni]

Hello,

with passive health monitoring there're 2 detect modes. If you use prefer-passive detect mode, it'll use probes when there's no traffic. But in this case, you've to setup link-monitor as well.

ref link: https://docs.fortinet.com/document/fortigate/7.0.0/new-features/208103/passive-wan-health-measuremen...

[BusinessUser]

So what happens if I use passive monitoring but there is no one using the link?

How does the firewall know if it is dead or alive?

[pminarik]

"If a tree falls down in a forest but there's nobody to hear it..." :)

Link monitoring is there to steer traffic away from non-functional, or badly performing, links. But if you have absolutely no traffic trying to pass through a given link, why would the perceived link state matter? If you need constant probing, nobody is stopping you from using active or prefer-passive monitoring.

In a real-life corporate scenario, a VPN link or a WAN link will have some traffic flowing through pretty much constantly. Link monitors can thus afford to be fully passive in these cases.

If you have a scenario where your monitored link can go completely silent for extended periods of time due to no interesting traffic being generated, then surely we can agree that fully-passive monitoring is not the right choice for such a link.

[asoni]

Hello,

with detect mode "passive", Fortigate doesn't really detect whether link is alive or dead. Instead, It can be used to select sdwan member under sdwan rules based on latency, packet loss or jitter threshold. 

[BusinessUser]

What is the point of setting passive mode if it doesnt check if link is dead or alive? I might as well set it to active then. But what is the purpose of setting it to passive in the first place?

I dont understand selecting members based on  latency, packet loss or jitter threshold. Isnt this under SLA instead?

[hbac]

Hi @BusinessUser,

Passive mode captures session information from firewall policy in used to determine latency, jitter, and packet loss. But it doesn't send any probes. Since there is no traffic passing the link, you can use active mode or prefer passive mode. Please refer to https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/867342/performance-sla-overv...

Regards,

[BusinessUser]

In that way is it better to put prefer passive or passive?

[xshkurti]

@BusinessUser 
In other words, active mode will send probes, passive mode will use information from inside fortigate (data gathered from active sessions) to determine link status.
For example if one user sends a ping (echo-request) and then receives a reply (echo-reply), fortigate decides that link is up because there were back and forth packets. Another example would be a TCP session from an internal user.  Fortigate checks packets SYN, SYN ACK, ACK, FIN etc, to decide that there is a stream that flows from inside network to outside world, so link is still alive or not.