Cyberoam Knowledge Base

Page 1 of 5

Configure Gateway Load Balancing and Failover

Applicable to Version: 10.00 onwards
Overview
Today organizations require stable, redundant and fast ISP links to run business critical applications. To achieve constant and secure availability to the Internet and to avoid
network vulnerability, organizations prefer to have multiple ISP links. Multiple ISP links provisions network administrator to configure failover and load balancing over Internet
links.
Cyberoam supports Load Balancing and Failover for multiple ISP links based on number of WAN ports available in the Appliance. You can terminate multiple ISP links on
available physical interfaces of Cyberoam in the form of Gateways. A Gateway can be configured as an Active or a Backup Gateway. The Gateways can be setup in Two (2)
ways:
Active-Active: Here, all Gateways are in Active State and traffic is Load Balanced between all Active Gateways. By default, Cyberoam adds a new gateway as an Active
Gateway. Hence, Load Balancing is automatically enabled between the existing and newly added links. Cyberoam employs weighted round robin algorithm for load balancing
to enable maximum utilization of capacities across the various links.
Active-Backup: Here, One (1) or more Gateways are configured as Backup. This setup allows Administrator to configure Gateway Failover if any active gateway goes down.
Note:
Load Balancing and Failover is supported both for IPv4 and IPv6 traffic. The Load Balancing or Failover can be done betw een Tw o (2) IPv4 gatew ays or Tw o (2) IPv6
gatew ays.

Scenario
Consider the hypothetical network in which one ISP link is terminated on Port B and Administrator wants to terminate another ISP link on Port D.

IP Schema
Below given IP schema is configured on Cyberoam.

Value
Parameters
Port A
IP Address
10.10.1.1
Subnet Mask
255.255.255.0
Zone
LAN
Port B
IP Address
172.16.16.1
255.252.240.0
Subnet Mask
Zone
WAN
Gateway Details
ISP Name
Default
IP Address
172.16.16.15
Port C
IP Address
10.10.10.1
Subnet Mask
255.255.255.0
DMZ
Zone
Port D
Port D is an unbound port so zone type for port D is set to N/A
DNS Configuration
4.2.2.2
Primary DNS
This article is divided into the following Three (3) sections:

http://kb.cyberoam.com/print.asp?id=2149&Lang=1&SID=

03/11/2014

Cyberoam Knowledge Base

Page 2 of 5

- Add a New Gateway

- Configure Load Balancing
- Configure Gateway Failover

Prerequisites
An unbound physical port should be available on Cyberoam. An unbound port is one, which is not assigned to any security zone.

Add a New Gateway

You must be logged on to the Web Admin Console as an administrator with Read-Write permission for relevant feature(s).
To add a gateway, go to Network > Interface > Interface and configure an unbound physical port according to parameters given below. Here, as an example, we have
configured Port D.

Parameters
General Settings
Physical Interface
Network Zone
IP Assignment

Value
PortD
WAN
Static

Description
Physical Interface for example, Port A, Port B
Select Zone to which Interface belongs.
Select IP Assignment type.
Available Options:
Static: Static IP Addresses are available for all the
zones.
PPPoE: PPPoE is available only for WAN Zone. If
PPPoE is configured, WAN port is displayed as the
PPPoE Interface.
DHCP:D H CP is available only for W AN Zone.

IP Address
Subnet Mask
Primary DNS
Secondary DNS
Gateway Details
Gateway Name
IP Address

10.10.2.1
/24 (255.255.255.0)
203.88.135.194
4.2.2.2

Specify IP Address.
Specify Network Subnet mask.
Specify Primary DNS Server IP Address.
Specify Secondary DNS Server IP Address.

PortD_Gateway
10.10.2.19

Specify Gateway Name

Specify IP Address of Gateway

http://kb.cyberoam.com/print.asp?id=2149&Lang=1&SID=

03/11/2014

Cyberoam Knowledge Base

Page 3 of 5

Click OK to update the interface.

On updating the interface, the gateway is added to the list of Gateways in Network > Gateway > Gateway.

Configure Load Balancing

Cyberoam allows Load Balancing between 2 or more Active-Active Gateways. By default, Cyberoam adds a new gateway as an Active Gateway. Hence, Load Balancing is
automatically enabled between the existing and newly added links.
Weighted Round Robin algorithm is used for load balancing wherein each link is assigned a weight. The traffic that Cyberoam distributes among the links is in proportion to the
weight assigned to them.
To assign weight to a Link, go to Network > Gateway > Gateway and select the required Gateway.

Mention the Weight, as shown below and click OK.

Configure Gateway Failover

Cyberoam allows Gateway Failover both in Active-Active and Active Backup setup.
In an Active-Active setup, if any one of the active gateways fails, the traffic is redirected to another active gateway. Administrator can specify Failover Conditions to indicate
how the failed gateway is to be detected.

http://kb.cyberoam.com/print.asp?id=2149&Lang=1&SID=

03/11/2014

Cyberoam Knowledge Base

Page 4 of 5

In Active-Backup setup, one or more of the gateways are configured as backup gateway. If an Active Gateway fails, the traffic can be redirected to a backup gateway,
ensuring Internet continuity.
Configure Backup Gateway
You can configure a gateway as a Backup gateway by following steps below.
1.

Go to Network > Gateway > Gateway and select the required Gateway.

2.

Select Gateway Type as Backup and configure Backup Gateway Details as shown below.

Click OK to save changes.

This setup indicates if any Active Gateway Fails, PortD_Gateway would get activated and would inherit the weight of the failed gateway.
Configure Failover Condition
By default, on adding a gateway, Cyberoam adds a Failover Rule indicating that if Cyberoam is not able to PING the gateway, it would be considered down, as shown below.

Click Add to add another rule, or Edit to change the existing rule. Here, as an example, we have added a Rule that indicates that if Cyberoam is not able to PING the
Gateway 172.16.16.15 and establish a TCP connection on port 80 with 4.2.2.2, the gateway will be considered down.

http://kb.cyberoam.com/print.asp?id=2149&Lang=1&SID=

03/11/2014

Cyberoam Knowledge Base

Page 5 of 5

Click OK to save the Gateway Failure Rule.

During a link failure, Cyberoam regularly checks the health of a given connection, assuring fast reconnection when Internet service is restored.
When the connection is restored and gateway is up again, traffic is rerouted through the Active gateway automatically.

Document Version: 2.1 19 May, 2013

http://kb.cyberoam.com/print.asp?id=2149&Lang=1&SID=

03/11/2014