Can I disable global Load Balancing if only one WAN is used on the firewall?

03/26/2020 79 11588

DESCRIPTION:

Can I disable global Load Balancing if only one WAN is used on the firewall? What are the dependencies of Load Balancing being enabled globally for SonicOS?

RESOLUTION:

It is never recommended to disable Failover & LB globally.

Failover and LB (FLB) actively monitors WAN connections and act accordingly on failure/recovery of the WAN interface(s). You should think of the overall effect as a system-wide response to failure/recovery of WAN connections.  Even if you only have one WAN, you still benefit because of faster recovery procedures performed on that one WAN as normal part of FLB.
 
It keeps status data for the WAN interfaces that can be queried by interested parties whenever they want.  Some SonicOS apps request asynchronous notification from FLB whenever a failure/recovery event happens on an interface they are interested in (normally, the Primary WAN) and those apps may perform some app-defined function which is outside the scope of FLB.
 
This is what FLB does when a WAN interface failure had been detected (linkDown or probing-failure or no-IP-settings):

1. Graceful shutdown of interface
2. Trigger the disabling of routes associated with failed interface (except for the ones marked "do not disable on link down")
3. Flush dynamic ARP entries using the failed interface
4. Flush the cache entries using the failed interface as outbound interface
5. Update WAN default route to point to an alternate WAN, if available. Update status data. (this is part of recovery procedure)
   • Address Objects used by other apps such as CASS gets updated as well
   • Security Services depend on this for failover capability
6. Notify interested parties (VPN, BWM, CASS, DDNS, DNS)
7. Actively monitor status of failed interface, attempt recovery such as restarting WAN connection

This is what FLB does when a WAN interface recovery had been detected (linkUp or probing-success or IP-change):

1. On linkUp, jump-start the interface connection. In most cases, this would be in connected state already, but if not, FLB attempts to push it to start. It may do graceful shutdown and restart if a hung condition is detected (timer based).
2. Once connectivity is confirmed (simple linkUp or probing), trigger enabling of routes associated with the interface
3. Add ARP entries (if any are needed)
   • Send out unsolicited ARP response (for interface) to update neighboring devices.
4. If needed, update the WAN default route (e.g. preempt) to use the best available WAN. Update status data.
   • Address Objects used by other apps such as CASS gets updated as well
   • Security Services depend on this for failover capability
5. Notify interested parties (VPN, BWM, CASS, DDNS, DNS)
6. Continue monitoring status of interface.