- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SDWAN Passive monitoring
If you use passive monitoring for SDWAN, how is the firewall going to detect the link is down assuming that there are zero users?
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
with passive health monitoring there're 2 detect modes. If you use prefer-passive detect mode, it'll use probes when there's no traffic. But in this case, you've to setup link-monitor as well.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So what happens if I use passive monitoring but there is no one using the link?
How does the firewall know if it is dead or alive?
Created on ‎09-25-2023 07:19 AM Edited on ‎09-25-2023 07:19 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
"If a tree falls down in a forest but there's nobody to hear it..." :)
Link monitoring is there to steer traffic away from non-functional, or badly performing, links. But if you have absolutely no traffic trying to pass through a given link, why would the perceived link state matter? If you need constant probing, nobody is stopping you from using active or prefer-passive monitoring.
In a real-life corporate scenario, a VPN link or a WAN link will have some traffic flowing through pretty much constantly. Link monitors can thus afford to be fully passive in these cases.
If you have a scenario where your monitored link can go completely silent for extended periods of time due to no interesting traffic being generated, then surely we can agree that fully-passive monitoring is not the right choice for such a link.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
with detect mode "passive", Fortigate doesn't really detect whether link is alive or dead. Instead, It can be used to select sdwan member under sdwan rules based on latency, packet loss or jitter threshold.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is the point of setting passive mode if it doesnt check if link is dead or alive? I might as well set it to active then. But what is the purpose of setting it to passive in the first place?
I dont understand selecting members based on latency, packet loss or jitter threshold. Isnt this under SLA instead?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @BusinessUser,
Passive mode captures session information from firewall policy in used to determine latency, jitter, and packet loss. But it doesn't send any probes. Since there is no traffic passing the link, you can use active mode or prefer passive mode. Please refer to https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/867342/performance-sla-overv...
Regards,
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In that way is it better to put prefer passive or passive?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@BusinessUser
In other words, active mode will send probes, passive mode will use information from inside fortigate (data gathered from active sessions) to determine link status.
For example if one user sends a ping (echo-request) and then receives a reply (echo-reply), fortigate decides that link is up because there were back and forth packets. Another example would be a TCP session from an internal user. Fortigate checks packets SYN, SYN ACK, ACK, FIN etc, to decide that there is a stream that flows from inside network to outside world, so link is still alive or not.
