Routing a two subnets through a two different WAN ports with mutual redundancy

a1601

Hello!

I need qualified advice how to organize the following scheme of work.

There are two Internet channels, connected to WAN1 and WAN2 (conventionally WAN1 - main channel, WAN2 - backup).
In "normal" mode subnet 192.168.1.0 (1) is routed through WAN1, subnet 192.168.4.0 (4) - through WAN2. This is solved by setting routing rules.
If link on WAN1 fails - the routing rule for WAN1 is disabled and the next rule for WAN2 starts working to switch the routing from network 1 to backup WAN2 (this is also solved by checking the availability in the rule for the WAN1). At the same time subnet 4 also continues to work through WAN2, everything is fine.
But if fails the backup channel WAN2 - need to switch subnet 4 to the main WAN1 - this is where the problem arises.
If i configure the rules to check the availability of WAN2 (to enable the next rule for routing subnet 4 to WAN1) - the check (ping 8.8.8.8 or any other) does not pass in the "normal" mode, this rule is immediately disabled (although channel 2 is working).

Is it possible somehow to make such a mutual reservation of channels for different subnets or is it impossible?

Policy routes:

policy 1
description ZYXEL-WAN1
interface ZyWALL
dscp any
service ZYXEL_SERVICE
next-hop interface wan1
auto-disable
conn-check 8.8.8.8 method icmp period 5 timeout 1 fail-tolerance 1
conn-check activate
!
policy 2
description ZYXEL-WAN2
interface ZyWALL
dscp any
service ZYXEL_SERVICE
next-hop interface wan2
!

policy 3
description LAN1-WAN1
interface lan1
dscp any
next-hop interface wan1
snat outgoing-interface
auto-disable
conn-check activate
conn-check 8.8.8.8 method icmp period 5 timeout 1 fail-tolerance 5
!
policy 4
description LAN1-WAN2
interface lan1
dscp any
next-hop interface wan2
snat outgoing-interface
!
policy 5
description LAN2-WAN2
interface lan2
dscp any
next-hop interface wan2
snat outgoing-interface
auto-disable
conn-check activate
conn-check 8.8.8.8 method icmp period 5 timeout 1 fail-tolerance 5
!
policy 6
description LAN2-WAN1
interface lan2
dscp any
next-hop interface wan1
snat outgoing-interface
!

Thanks in advance!

a1601

Sorry again, I misled you. I found my mistake in the settings, everything works as it should now. Thanks for the help!

PeterUK

It should work what you have done...if you unplug WAN2 LAN2 should use WAN1

Maybe change one of the ping to 8.8.4.4

There is this firmware saying about a fix for fail over

https://community.zyxel.com/en/discussion/18656/zld-v5-37wk30-firmware-release#latest

Zyxel_James

Yes, I think your routing configuration can work.
When WAN1 fails, policies 1, 3, and 6 would automatically disable themselves, and both would be routed through WAN2, and vice versa.

a1601

https://community.zyxel.com/en/discussion/comment/56653#Comment_56653

But when both WAN1 and WAN2 work and Enable Connectivity Check for policie 5 - it policie is disabled and both networks routed through WAN1.. (need routed LAN2 through WAN2). Connectivity Check disabeled - it works.
Pinging another IP for check (8.8.4.4) - it didn't help.

PeterUK

Maybe I'm missing something?

So with ping check working the following happens

LAN1 goes out WAN1

LAN2 goes out WAN2

ping check fails on WAN1

LAN1 goes out WAN2

LAN2 goes out WAN2

ping check fails on WAN2

LAN1 goes out WAN1

LAN2 goes out WAN1

a1601

https://community.zyxel.com/en/discussion/comment/56658#Comment_56658

Yes, everything is described correctly, that’s exactly what I want to do. But for some reason it doesn’t work and I don’t understand why.

PeterUK

so if you put in a test IP where the ping will fail like 127.0.0.2 this will fail the check for testing.

So what is it your seeing? LAN2 when ping is fine not going out WAN2?

a1601

https://community.zyxel.com/en/discussion/comment/56660#Comment_56660

Ping check for any IP (8.8.8.8, 8.8.4.4 and other) for policies LAN2-WAN2 is fail.

Settings:

Result (WAN1 and WAN2 works fine, LAN2 going out WAN1):

a1601

Sorry, today my tests are incorrect, because in reality there are problems with the provider for WAN2. I'll check again later.

a1601

Sorry again, I misled you. I found my mistake in the settings, everything works as it should now. Thanks for the help!