6 Replies Latest reply on Jul 13, 2010 4:46 PM by sliedl

    Two ISP and McAfee Enterprise Firewall 8

    Canonier

      Hi.

      I need your help.

      There are McAfee Enterprise Firewall 8 and two ISP. I have to configure it for two ISP. It means that If the first ISP becomes unavialable, second ISP provide the Internet. It means too that second ISP becomes unavialable, route return in first ISP.

      I configured two static routes - Primary Default Route and Alternate Default Route. If I turn off first ISP, MFE switches to second ISP, but if I then turn on first ISP and turn off second ISP, MFE does not switch to first ISP.

      Why?

      How can I solve my problem? May be, this problem solve somehow else?

       

      Thank you. Sorry for my English

        • 1. Re: Two ISP and McAfee Enterprise Firewall 8
          sliedl

          Unfortunately the firewall does not have this capability.  From the man page of the 'cf static' command (the command to edit static routes):

          $> man cf_static

           

          Once a backup route is configured, the ispd daemon monitors the state and status of the default route.  If a loss of connectivity is detected the ISP daemon will change the default route to the backup default route.  When the default route becomes available again, the administrator may initiate a switch back to it by use of the cf static reset_default command.  No automatic fail-back will be performed.

           

          You cannot configure the firewall to automatically fail-back to using the default route when it becomes available again, unfortunately.

          • 2. Re: Two ISP and McAfee Enterprise Firewall 8
            Canonier

            May be, May it to do somewhere else? May be, I have to use any protocol of Dinamic Routing?

            • 3. Re: Two ISP and McAfee Enterprise Firewall 8
              sliedl

              Dynamic routing is a much, much, much more complicated setup than simply switching back to your 'regular' default route when it becomes available.  If you do not have any experience with dynamic routing I do not recommend using it.  What you are trying to do also will not work with dynamic routing unless there is some other device outside your firewall that knows when your default route 'goes down' and can then send you a new default route (basically).  This would require you to setup dynamic routing on some other device along with your Sidewinder.

              • 4. Re: Two ISP and McAfee Enterprise Firewall 8
                oreeh

                Here's how I'd do this:

                 

                Monitor the different connections using your favorite monitoring tool (I prefer Icinga/Nagios).

                When the primary connectivity becomes available again launch a short expect script on the monitoring host which issue the cf static reset_default command.

                 

                 

                Message was edited by: oreeh on 7/13/10 5:00:05 PM CEST
                • 5. Re: Two ISP and McAfee Enterprise Firewall 8
                  Canonier

                  Thank you everybody. But I have another question. Why I get "operation not permitted" if I try to use "cf" command in console of Operation System? I try to add static route. I ran either other command, but my result was the same.

                  I have the account "Admin" with GID=0 This account was created during installing MFE. I do not know root password, but "Admin" account must have full access.

                  What do I wrong?

                  • 6. Re: Two ISP and McAfee Enterprise Firewall 8
                    sliedl

                    Type 'srole' on the command-line to go to the 'super-user' account (if you can call it that).