- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
Can GMS provide alerts when a secondary Internet line is down? (GMS Live Monitor)
03/26/2020 
1,066 People found this article helpful
97,613 Views
Description
Setting up GMS Live Monitor for Alerting on changes to Secondary WAN Status. GMS can provide alerts when a secondary Internet line is down.
Note: This article applies to GMS 6.0 and above.
Resolution
Make sure Failover & LB is setup correctly in SonicOS. In the following setup, X1 and X3 interfaces have been setup for WAN Zone:
Enable Logical/Probe Monitoring for each of the above interfaces. For instance, for X3:
When a probe fails, the following syslog is sent:
<129>id=firewall sn=0017C52DFBF1 time="2011-10-04 22:33:09 UTC" fw=10.0.14.200 pri=1 c=2 m=586 msg="WLB Resource failed" n=6 src=10.50.20.21:0:X3: dst=0.0.0.0:0::
When the probe succeeds after having failed before, the following syslog is sent:
<129>id=firewall sn=0017C52DFBF1 time="2011-10-04 22:29:29 UTC" fw=10.0.14.200 pri=1 c=2 m=585 msg="WLB Resource is now available" n=6 src=10.50.20.21:0:X3: dst=0.0.0.0:0::
We can then use Live Monitor to capture the above syslogs and alert based on those syslogs, as follows.
Go to Monitor Tab | Live Monitor screen, and click Manage Rules.
Click on the Plus (+) icon to add a new rule and fill in the details as below:
Next click the pencil icon and fill the values as below and click Next. Note that the value 586 is associated with syslog with message “WLB Resource failed” as explained earlier.
Next, add a Destination for the Alerts, typically an email address as below and then click Finish.
Similarly, add another Rule for WLB Recovery (with message ID = 585):
In the end you will see the following two rules added:
For the rules to take effect, make sure the Syslog Forwarding is running. Click on the Settings link in Live Monitor and make sure the checkbox is selected:
If you are in the Live Monitor UI and the Reader is running (by clicking on the Play button on top left), you will see the alerts in the Window as follows:
Expanding each alert will show more details as follows:
In GMS 7.0, in addition you will be able to view the actual syslog(s).
The alerts will be emailed to you whether or not the Live Monitor UI is active or not.
Here are some sample email alerts:
Related Articles
- How to backup and Restore an NSM On-Prem System?
- How to upgrade SonicCore and NSM in closed network
- On-Premises Analytics 2.5 - Reset Password
YES
NO