Route monitoring to FGSP peer NEW

Route monitoring to FGSP is available, enhancing network stability by detecting route prefix withdrawals. This prevents black holing in complex environments and improves the UTM scanning experience.

Route monitoring to FGSP peers can be configured in the CLI:

config system standalone-cluster
    config monitor-prefix
        edit <ID>
            set vdom <VDOM name>
            set vrf <VRF ID>
            set prefix <ip address and netmask>
        next
    end
end

Example

In the following configurations, two peers are configured in FGSP, and a list of routing prefixes to monitor are configured.

To configure route monitoring to FGSP:

1. Configure two peers in FGSP:

   config system standalone-cluster
       set standalone-group-id 1
       config cluster-peer
           edit 1
               set peerip 10.2.2.2
           next
       end
       config monitor-prefix 
           edit 1
               set vdom "root"
               set prefix 192.168.2.0 255.255.255.0
           next
           edit 2
               set vdom "root"
               set prefix 20.1.1.0 255.255.255.0
           next
       end
   end

2. Verify the health status on peer_1:

   #diagnose test application sessionsync 1
   HA is not enabled
   sync context:
           sync-enabled=0, sync-tcp=1, sync-nat=0
           sync-other=1, sync-exp=1, standalone-sync=1, mtu=0
           ipsec-tun-sync=1, encrypt-enabled=0
   fgsp-peers-num=1, kernel-filters-num=1
   fgsp-peers:
           vdom=0, ip/port=10.2.2.2:708
   fgsp_route_health=1
           mon_prefix: vdom=root vrf=0, prefix=192.168.2.0(255.255.255.0) healthy=1
           mon_prefix: vdom=root vrf=0, prefix=20.1.1.0(255.255.255.0) healthy=1

   Traffic originally passes through UTM inspection over peer_1. The return traffic is routed to peer_2, where it will bounce to peer_1, the original FGSP peer for inspection.

   When the routing prefix becomes unavailable, the health status immediately changes to unhealthy.

   #diag test application sessionsync 1
   HA is not enabled
   sync context:
           sync-enabled=0, sync-tcp=1, sync-nat=0
           sync-other=1, sync-exp=1, standalone-sync=1, mtu=0
           ipsec-tun-sync=1, encrypt-enabled=0
   fgsp-peers-num=1, kernel-filters-num=1
   fgsp-peers:
           vdom=0, ip/port=10.2.2.2:708
   fgsp_route_health=0
           mon_prefix: vdom=root vrf=0, prefix=192.168.2.0(255.255.255.0) healthy=1
           mon_prefix: vdom=root vrf=0, prefix=20.1.1.0(255.255.255.0) healthy=0

   Upon peer_1 becoming unavailable or unhealthy, traffic no longer bounces back to peer_1. Instead, it is failed over to peer_2 for processing.