Athena NGFW (Next-Generation Firewall)

Athena NGFW (previously known as Network Secure) provides comprehensive protection for every network perimeter, ensuring the safety of your valuable assets, data, and users from emerging threats.
{{ $t('productDocDetail.guideClickSwitch') }}
{{ $t('productDocDetail.know') }}
{{ $t('productDocDetail.dontRemind') }}
8.0.107
{{sendMatomoQuery("Athena NGFW (Next-Generation Firewall)","Link State Detection")}}

Link State Detection

{{ $t('productDocDetail.updateTime') }}: 2026-02-05

Link State Detection is used to detect the effectiveness of WAN links. In scenarios involving multiple WAN links, traffic automatically switches to other normal links if one of the links fails. Detection methods include ARP Probe, DNS Lookup, PING, and BFD. As shown in the figure below.

Failure Trigger: You can select All fail or One fails. When All fail is selected, the link is considered down if the results of all detection methods show the link failed. When One fails is selected, the link is considered down if one detection method shows the link failed.

ARP Probe: Detect the link state by sending ARP packets to the specified network devices in a group. Each group can contain two destination IP addresses at most, and the two IP addresses must be separated by a comma.

DNS Lookup: Detect the link state by sending DNS resolution requests to the specified DNS servers. You can configure two groups of DNS servers at most. The link will be considered failed if either group fails to resolve the domain name.

PING: Detect the link state by pinging the specified servers. You can configure two groups of destination IP addresses at most. Each group can contain two destination IP addresses at most, and the two IP addresses must be separated by a comma. The link will be considered failed if all IP addresses in either group fail to respond to the ping request.

BFD: As BFD is based on RFC 5880, BFD sessions at both peers are required to establish a detection system. Link state is detected by using UDP port 3784 to identify BFD control packets and UDP port 3785 to identify BFD echo packets.