topic Re: when we added new pbr rules,The gateway did not answer 10 minutes in General Topics

when we added new pbr rules,The gateway did not answer 10 minutes

Thecoder — Thu, 28 Jun 2018 07:50:53 GMT

hello

when we added new pbr rules,The gateway did not answer ssh,web interface for 10 minutes. and vpn users droped and can not reconnect 10 minutes. but imternals client can connect to the internet and the gateway gives arp reply.

version informaiton: R80.10 take 112

we tried at take 103 and took same results

thanks

Re: when we added new pbr rules,The gateway did not answer 10 minutes

Timothy_Hall — Thu, 28 Jun 2018 15:54:20 GMT

There have been SecureXL issues with PBR and dynamically-updating routes in the past, although PBR is fully supported with SecureXL in R80.10 by default as stated here: sk109741: Packets are not routed correctly when PBR is configured and SecureXL is enabled. It is possible that while configuring PBR an incomplete configuration started impacting traffic and confused SecureXL. Try this:

fwaccel off (If your firewall has more than 8 cores schedule an outage window before doing this)

(add PBR routes & test)

fwaccel on

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

Re: when we added new pbr rules,The gateway did not answer 10 minutes

Thecoder — Fri, 29 Jun 2018 07:08:35 GMT

we didnt use securexl.when i opened securexl, problem was solved. thanks Tim