NetBalancer gateways displaying Faulty/Inactive

Configuration Checks

• Ensure WAN interfaces used for Internet, Tunnel, or SaaS breakout have ICMP failover configured with reachable public IP addresses. Gateway IPs for Internet and SaaS can overlap when using WAN interfaces.
• For Tunnel interfaces used for Internet breakout, configure the correct remote gateway IP to reach the remote LAN. Remote tunnel gateway IPs must be unique per branch.
• If LTE interfaces do not display the correct gateway IP, try enabling/disabling the NetBalancer (NB) gateway.
• Branches using LTE interface gateways should always use ICMP failover, as LTE gateways may not allow ping or ARP requests.
• If an NB gateway using an LTE interface appears faulty, verify that:
  • The LTE plan is active and has not exceeded the monthly data limit (for both postpaid and prepaid plans).
  • This information can typically be found in the LTE provider’s account portal.
• Some LTE providers block certain traffic types (e.g., IPSec, UDP, ICMP). Confirm with your LTE provider that traffic is not restricted.
• For Internet Breakout (IB) and Tunnels, ensure tunnels are assigned the correct affinity to IB gateways.
• In an IB-to-Data Center (DC) setup, ensure tunnels to the DC are correctly assigned to branch gateways. The DC IPs must be publicly reachable.
• Remote LAN subnets must be unique across branches unless they are used for Internet or SaaS breakout.

IPSec Tunnel Issues

• If an IPSec tunnel is established but the NB gateway appears faulty:
  • Check IPSec tunnel connections to ensure the corresponding endpoint is green and has a remote subnet.
  • Ensure the tunnel IP is unique across Edge Controllers (ECs) in the same network topology.

Advanced Options

• If NetBalancer is not detecting faults on any configured gateway or new gateway IPs (for LTE or DHCP networks) are not updating automatically, restart the link monitor for NetBalancer.
• Note: Restarting the link monitor will disrupt all traffic on the EC for several minutes.