Scenario:

An enterprise has two internet outbound lines: the primary line (ISP1) and a backup line (ISP2). The primary line's eth2 interface connects to ISP1 gateway 1.1.2.1, and the backup line's eth4 interface connects to ISP2 gateway 2.2.2.1. The enterprise requires automatic failover to the backup line when the primary line fails to ensure high availability.

Objectives:

Configure the primary and backup static routes. Set the administrative distance of the primary route to 1 and the backup route to 10 (floating route) to achieve automatic failover to the backup line when the primary line fails.

Topology:

Prerequisites:

• Athena NGFW has completed basic configurations. Only routing behavior is considered in this scenario. All other policies are assumed to allow traffic by default.

• The IP address of Athena NGFW's interface eth1 is 192.168.1.1/24.

• The IP address of Athena NGFW's interface eth2 is configured as 1.1.2.2/24, connected to the ISP1 line.

• The IP address of Athena NGFW's interface eth4 is configured as 2.2.2.2/24, connected to the ISP2 line.

• Athena NGFW has created link detection objects to detect the connectivity to the ISP1 and ISP2 gateways, respectively.

Configuration steps:

Step 1. Log in to the Athena NGFW console, go to Network > Routes > Static Routes > IPv4, click Add to configure the default route for the primary line.

Dst IP/Netmask: Enter 0.0.0.0/0.

Next-Hop IP: Enter 1.1.2.1.

Interface: Select eth2 from the drop-down list.

Administrative Distance: Keep the default value 1.

Reliability Detection: Select Link State, and select the link detection object for the ISP1 gateway.

Step 2. Go to Network > Routes > Static Routes > IPv4, and click Add to configure the default route for the backup line (floating route).

Dst IP/Netmask: Enter 0.0.0.0/0.

Next-Hop IP: Enter 2.2.2.1.

Interface: Select eth4 from the drop-down list.

Administrative Distance: Set it to 10 (larger than the primary route to implement a floating route).

Reliability Detection: Select Link State, and select the link detection object for the ISP2 gateway.

Result verification:

• Go to Network > Routes > Static Routes > IPv4 to verify that the newly added route exists in the route list, and only the primary route with an administrative distance of 1 is valid.

• Simulate a primary line failure (disconnect eth2 or trigger a link detection failure), check the routing table, and verify that the primary route becomes invalid, and the backup route is automatically validated.

• Verify that internal users can still access the internet normally (via the backup line).

• Verify that the route automatically switches back to the primary line once it is recovered.

{{ $t('index.defaultHeader.logo') }}

Athena NGFW (Next-Generation Firewall)

Case: Configure Floating Static Routes for Route Backup