Netgate to Enhance Gateway Recovery in pfSense Plus Version 24.03

Netgate® is pleased to announce that pfSense® Plus software version 24.03 will include an enhanced gateway recovery process, with options to reset connections made through a backup gateway while the primary gateway is offline. This feature will allow connection fail-back to a primary gateway after downtime, should the primary and secondary have unbalanced bandwidth (ex. primary has 10Gbps, and backup is 1Gbps).

Overview

In the failover process within a gateway group, if one gateway has a failure, all new connections will be routed through the backup gateway, and the connections going through the failed gateway may be reset, allowing them to reconnect via the backup gateway.

When a failed gateway in a failover group comes back online, the admin will have the option to reset all of the connections made through the backup gateway while the primary was offline (by killing their states).

This capability is particularly valuable when one gateway in a group configured for failover has high bandwidth and the other gateway has less bandwidth (perhaps even a metered connection). Keeping connections alive on the backup gateway may not be desirable once the high-bandwidth gateway is back online.

Note: This feature is exclusive to pfSense Plus software version 24.03. 

New Options - Gateway Monitoring

Gateway Monitoring options are found at System > Advanced, Misc tab.

State Killing on Gateway Recovery

Connections from the firewall itself can fail over to other gateways by setting a failover gateway group as the system’s default gateway. By killing states on lower-priority gateways after a higher-priority gateway recovers, these connections can re-establish on the preferred gateway. This option overrides the failover gateway group’s state-killing behavior by affecting all states, not only those created by policy routing rules.

• Don’t kill states from the firewall itself (default)

States from the firewall itself are unaffected. The configured failover gateway group determines the state-killing behavior for states created by policy routing rules.

• Kill all states for lower-priority gateways

All states on lower-priority gateways are killed when a higher-priority gateway returns to an online state.

• Only kill states with the same Address Family as the gateway group

States of the same Address Family as the gateway group are killed for lower-priority gateways.

States from policy routing rules

The state-killing behavior on gateway recovery handles policy routing states separately. This allows for applying different behaviors to different types of traffic. For example, one gateway group can handle general internet traffic by killing states on both gateway failure and recovery. Separately, another group handling VOIP traffic would only kill states on gateway failure to avoid interrupting active calls.

• Don’t kill policy routing states for lower-priority gateways

Controls the default state-killing behavior for states created by policy routing rules using a failover gateway group. This behavior may also be controlled per gateway group. If unchecked (default), policy routing states on lower-priority gateways are killed when a higher-priority gateway recovers.

New Options - Configuring Recovery for a Gateway Group

New gateway group configuration options are found at System > Routing, Gateway Groups tab.

Keep Failover States

This new setting affects states created by policy routing rules. It controls the state-killing behavior for the gateway group which takes effect when a higher-priority gateway returns online. 

• Use global behavior (default)
  
• Keep states on gateway recovery
  States created by policy routing rules using this gateway group are unaffected when a higher-priority gateway returns online. Connections established on failover gateways will remain on those gateways until reconnected.
• Kill states on gateway recovery
  States created by policy routing rules using this gateway group are killed when a higher-priority gateway returns online. This option does not affect traffic from the firewall itself.

Conclusion

The goal of a high-availability failover group is to ensure as little network disruption as possible. The gateway recovery feature enables the administrator to fail-back the connections once the primary gateway comes back online, maximizing performance & availability for the user base.

Netgate continues to listen to our customers, enhancing the pfSense Plus software experience to add capabilities while maintaining the industry’s best price/performance ratio and the lowest TCO.