Filter
Top Products
System Logs and Error Messages
652
ProSecure Unified Threat Management (UTM) Appliance
This section describes the logs that are generated when the WAN mode is set to
auto-rollover.
Load Balancing Mode
When the WAN mode is configured for load balancing, both the WAN ports are active
simultaneously and the traffic is balanced between them. If one WAN link goes down, all the
traffic is diverted to the WAN link that is active.
Table 168. System logs: WAN status, auto rollover
Message Nov 17 09:59:09 [UTM] [wand] [LBFO] WAN1 Test Failed 1 of 3 times_
Nov 17 09:59:39 [UTM] [wand] [LBFO] WAN1 Test Failed 2 of 3 times_
Nov 17 10:00:09 [UTM] [wand] [LBFO] WAN1 Test Failed 3 of 3 times_
Nov 17 10:01:01 [UTM] [wand] [LBFO] WAN1 Test Failed 4 of 3 times_
Nov 17 10:01:35 [UTM] [wand] [LBFO] WAN1 Test Failed 5 of 3 times_
Nov 17 10:01:35 [UTM] [wand] [LBFO] WAN1(DOWN), WAN2(UP),
ACTIVE(WAN2)_
Nov 17 10:02:25 [UTM] [wand] [LBFO] WAN1 Test Failed 6 of 3 times_
Nov 17 10:02:25 [UTM] [wand] [LBFO] Restarting WAN1_
Nov 17 10:02:57 [UTM] [wand] [LBFO] WAN1 Test Failed 7 of 3 times_
Nov 17 10:03:27 [UTM] [wand] [LBFO] WAN1 Test Failed 8 of 3 times_
Nov 17 10:03:57 [UTM] [wand] [LBFO] WAN1 Test Failed 9 of 3 times_
Nov 17 10:03:57 [UTM] [wand] [LBFO] Restarting WAN1_
Explanation The logs suggest that the failover was detected after 5 attempts instead of
3 attempts. However, the reason that these messages appear is because of the
WAN state transition logic that is part of the failover algorithm. You can interpret the
logs in the following way:
The primary link failure is correctly detected after the 3rd attempt. Thereafter, the
algorithm attempts to restart the WAN and checks once again if WAN1 is still down.
This results in the 4th failure detection message. If WAN1 is still down, the algorithm
starts the secondary link. When the secondary link is up, it is marked as active.
Meanwhile, the secondary link has failed again, and this results in the 5th failure
detection message. Note that the 5th failure detection and the message suggesting
that the secondary link is active have the same time stamp, and so they happen in
the same algorithm state-machine cycle. Although it appears that the failover did
not occur immediately after 3 failures, internally, the failover process is triggered
after the 3rd failure, and the transition to the secondary link is completed by the 5th
failure. The primary link is also restarted every 3 failures until it is functional again.
In these logs, the primary link was restarted after the 6th failure, that is, 3 failures
after the failover process was triggered.
Recommended Action Check the WAN settings and WAN failure detection method configured for the
primary link.