Sticky connections not working with dual WAN

TheCableGuy96 · Jun 9, 2020, 10:08 AM

Well if that's the case it is a bug then. But at least there appears to be a workaround.

I'll test it now, cheers again :)

netblues · Jun 9, 2020, 10:08 AM

@Daskew78 nope
We suggest to put a weight of 2 on both gateways and load balance them as both tier 1.
with a stickiness of 2500

johnpoz · Jun 9, 2020, 10:10 AM

As you see yes there is a redmine on it ;)

Currently targeted at 2.5 - but its been pushed many times already.. So wouldn't expect... This thread could get added to that redmine I would think.. Might put a bit more weight on looking into it.

TheCableGuy96 · Jun 9, 2020, 10:11 AM

Sorry I spoke a little too soon.... should I also set the sticky connections back to "0"?

netblues · Jun 9, 2020, 10:14 AM

@Daskew78 NO, it won't work on web banking sites

TheCableGuy96 · Jun 9, 2020, 10:24 AM

Sorry I was replying too fast and missed your update about setting the states to 2500.

I have set it to 2500 and set each gateway to Tier 1 but I can't see where I set a weight of 2? Where is the weight setting?

Rico · Jun 9, 2020, 10:26 AM

System > Routing > Edit Gateway > Display Advanced > Weight

-Rico

TheCableGuy96 · Jun 9, 2020, 10:27 AM

ahhh thank you.... i'm testing now... will update shortly :)

netblues · Jun 9, 2020, 10:33 AM

Remember to clear states and source tracking.

TheCableGuy96 · Jun 9, 2020, 10:37 AM

Yeah I cleared both, closed all browsers and tried again on 2 personal servers with single IPs and banking but it's still happening.

I must admit it doesn't seem to be happening as much but it is still happening.

netblues · Jun 9, 2020, 10:47 AM

I also see that you have default gateway on a load balancing group.
Try to put default gateway to a failover group, (or just one of the lines).

It is not recommended to do that.

Also, for debug purposes, make a policy routing just for https and put it ahead of general load balancing rule, and redirect traffic to another load balancer (with the same members)
So as to make sure https traffic is not mixed with anything else and retest.

TheCableGuy96 · Jun 9, 2020, 10:49 AM

Okay i'll have to get back to you tomorrow as I have to go out now.

Thanks buddy :)

TheCableGuy96 · Jun 10, 2020, 8:38 AM

@netblues Sorry for the delay I was busy yesterday...

I just want to check we are on the same page here:
"I also see that you have default gateway on a load balancing group. Try to put default gateway to a failover group, (or just one of the lines)."

Are you referring to the firewall rules defining the gateway for each vLAN or the section in "System > Routing > Default Gateway"?

Also, I'm sorry but I don't understand what you mean when you say:
"Also, for debug purposes, make a policy routing just for https and put it ahead of general load balancing rule, and redirect traffic to another load balancer (with the same members)"

Please could you elaborate a little more what you are suggesting?

Many thanks pal :)

netblues · Jun 10, 2020, 9:40 AM

@Daskew78 said in Sticky connections not working with dual WAN:

@netblues Sorry for the delay I was busy yesterday...

I just want to check we are on the same page here:
"I also see that you have default gateway on a load balancing group. Try to put default gateway to a failover group, (or just one of the lines)."

Are you referring to the firewall rules defining the gateway for each vLAN or the section in "System > Routing > Default Gateway"?

Yes..

Also, I'm sorry but I don't understand what you mean when you say:
"Also, for debug purposes, make a policy routing just for https and put it ahead of general load balancing rule, and redirect traffic to another load balancer (with the same members)"

Please could you elaborate a little more what you are suggesting?

see here

Many thanks pal :)

ssl failover load balances first and failovers if both lines are not availabie

so we just make sure https traffic is handled by policy rule.
You can also log packets if needed.

TheCableGuy96 · Jun 10, 2020, 10:58 AM

@netblues Okay "System > Routing > Gateways > Default gateway IPv4" is now set to WAN1 rather than a LoadBalancing profile.

I think I understand you with the rule but I need to set up the gateway group to assign it to before I can and this is where I'm still a little hazy.

Am I selecting one of the gateways in here or both? and what "Tier" and "Trigger Level" please? This is what I have currently but not sure if it's what you are suggesting?

Thanks.

netblues · Jun 10, 2020, 11:13 AM

@Daskew78 call it ssL_loadbalance so as not to be confused.
put both lines as tier1
and make trigger level member down, to be on the safe side, while testing.

And do check you have weights set to 2 in routing gateways for both wan1_pppoe and wan2_dhcp

TheCableGuy96 · Jun 10, 2020, 11:26 AM

@netblues

Can you just confirm these settings are all correct what you are suggesting, please?

TheCableGuy96 · Jun 10, 2020, 11:28 AM

Forgot to mention I also have the weights set to "2" for each WAN.

netblues · Jun 10, 2020, 11:32 AM

Looks ok and I also see traffic matching the ssl rules...
Also confirm that stickiness is at 2500 (or any other non zero value. - 2500 seems reasonable for any banking site..)

Try accessing some banks/ssl sites.. what happens?

TheCableGuy96 · Jun 10, 2020, 11:43 AM

@netblues Still happening, unfortunately. I was logged out of my bank so I tried my own server. It was looking pretty stable but I did get logged out. When I checked the logs it shows 2 connections from different IPs within a couple of minutes:

2020:06:10-12:36:55: '217.45.xxx.xxx' successful login to 'user' via 'admin' after 1 attempts
2020:06:10-12:37:24: '5.70.xxx.xxx' successful login to 'user' after 1 attempts

Also sticky connections are confirmed at 2500.

It's just a bug, I guess I'll have to wait until they resolve it. I can work around it for now with static routes/firewall rules.