5.1 Multi-WAN Methods & Load Balancing

5.1 Multi-WAN Methods & Load Balancing

Quick Answer: WatchGuard Fireware OS activates Multi-WAN whenever two or more physical or VLAN interfaces are configured as External. Administrators can select from four global operational modes: Routing Table (follows route metrics and ECMP), Round-Robin (distributes outbound connections based on interface weights from 1 to 100), Failover (maintains a strict priority order of primary and backup links), and Interface Overflow (directs traffic through the primary link until a configured bandwidth ceiling in Kbps or Mbps is exceeded, spilling excess connections to backup links). To prevent session disruption on banking portals and secure HTTPS applications, Sticky Connections calculate a hash of the source and destination IP addresses to keep subsequent requests anchored to the same egress External interface for a configurable duration (default 3 minutes).

---

Architectural Drivers for Multi-WAN Deployments

Modern enterprise networks depend heavily on continuous, uninterrupted cloud and Internet connectivity. A single WAN outage can paralyze corporate operations, halting point-of-sale transactions, cloud-hosted enterprise resource planning (ERP) systems, voice-over-IP (VoIP) telephony, and inter-branch communications. Deploying multiple WAN circuits from diverse Internet Service Providers (ISPs) terminates single points of failure at the network perimeter.

WatchGuard Fireware OS provides native Multi-WAN capabilities that transform multi-homed perimeter connections into an integrated, resilient transport fabric. Multi-WAN addresses three distinct operational objectives:

1. High Availability and Link Redundancy: Automatic detection of circuit failures and instantaneous diversion of outbound traffic to healthy secondary circuits without requiring manual administrative intervention.
2. Bandwidth Aggregation and Outbound Load Sharing: Distributing outbound client connections across multiple active Internet connections concurrently, maximizing aggregate throughput and optimizing ISP circuit utilization.
3. Cost Optimization (Hybrid WAN): Directing high-priority, latency-sensitive business traffic through expensive dedicated circuits (such as leased lines, fiber optic links, or Carrier Ethernet), while routing bulk web browsing, video streaming, and guest Wi-Fi over lower-cost commodity broadband (such as commercial cable or DSL).

Prerequisites in Fireware OS

To enable Multi-WAN functionality on a Firebox, the following prerequisites must be met:

• The Firebox must operate in Mixed Routing mode. Multi-WAN is not supported in Drop-in mode or Bridge mode.
• At least two physical interfaces, Link Aggregation Groups (LAGs), or VLAN interfaces must be configured with the interface type set to External.
• Each External interface must be assigned an IP address (static, DHCP, or PPPoE) and a valid default gateway IP address.

Once two or more External interfaces exist in the configuration, the Multi-WAN configuration panel becomes accessible in Fireware Web UI (Network > Multi-WAN) and WatchGuard System Manager (WSM) Policy Manager (Network > Configuration > Multi-WAN tab).

---

The Four Fireware Multi-WAN Operating Modes

Fireware OS allows administrators to define a global Multi-WAN operating mode that dictates how outbound connections matching the default route (0.0.0.0/0) are distributed across active External interfaces.

                    ┌─────────────────────────┐
                    │ Multi-WAN Configuration │
                    └────────────┬────────────┘
                                 │
       ┌─────────────────────────┼─────────────────────────┐
       │                         │                         │
┌──────┴──────┐           ┌──────┴──────┐           ┌──────┴──────┐
│ Routing     │           │ Round-Robin │           │ Failover    │
│ Table Mode  │           │ Mode        │           │ Mode        │
└─────────────┘           └─────────────┘           └─────────────┘
                                 │
                          ┌──────┴──────┐
                          │ Interface   │
                          │ Overflow    │
                          └─────────────┘

1. Routing Table Mode

In Routing Table mode, Multi-WAN does not actively orchestrate or balance outbound connections. Instead, the Firebox evaluates outbound packet forwarding strictly using its internal routing table:

• The Firebox inspects the destination IP address of each outgoing packet and consults its static routes, dynamic routing protocol routes (OSPF, BGP, RIP), and default gateways.
• If multiple default routes exist pointing to different External interfaces, the route with the lowest metric is selected.
• If multiple routes to the same destination have identical prefix lengths and identical metrics, Fireware utilizes Equal-Cost Multi-Path (ECMP) routing to hash traffic across the competing gateways.

Exam Tip: Routing Table mode is the preferred configuration when external upstream routers or dynamic routing protocols (such as BGP multi-homing) manage path selection and route redistribution dynamically, or when administrators wish to control all routing exclusively via manually defined static routes and metrics.

2. Round-Robin Mode

Round-Robin mode provides active-active load sharing across all configured External interfaces. In this mode, every enabled External interface simultaneously processes outbound client traffic.

Operational Mechanics:

• Interface Weights: Administrators assign an integer weight between 1 and 100 to each participating External interface. The weight represents the proportional ratio of new connections assigned to that interface relative to the total sum of weights across all active interfaces.
• Mathematical Distribution: If External interface Eth0 is configured with a weight of 10 (representing a 100 Mbps fiber circuit) and External interface Eth2 is configured with a weight of 5 (representing a 50 Mbps broadband backup), the Firebox distributes new outbound connections in a 2:1 ratio. Out of every 3 new outbound sessions, 2 sessions are dispatched through Eth0 and 1 session is dispatched through Eth2.
• Connection-Based vs. Packet-Based: Round-Robin in Fireware balances traffic per connection, not per packet. When a client initiates a TCP handshake (SYN) or sends an initial UDP datagram, the Multi-WAN engine assigns that entire connection to an External interface. All subsequent packets belonging to that specific socket pair flow through that identical interface until the session terminates. A single gigabyte-sized FTP file download or video stream will traverse only one interface; it is not split or striped across multiple links.
• Automatic Failure Exclusion: If an interface fails its Link Monitor health checks, the Firebox automatically removes it from the active Round-Robin rotation. Traffic is dynamically redistributed among the remaining functional External interfaces according to their relative weights.

3. Failover Mode

Failover mode provides an active-passive redundancy architecture designed for organizations that want to route all Internet traffic through a single high-performance or low-cost primary circuit, reserving secondary circuits strictly for emergency backup.

Operational Mechanics:

• Priority Ordering: The administrator establishes a strict hierarchical list of External interfaces. The interface at the top of the list is designated as the Primary interface, while interfaces beneath it serve as Backup 1, Backup 2, and so on.
• Single Active Path: All outbound traffic flows exclusively through the Primary interface as long as that interface remains healthy and functional.
• Failover Trigger: If the Primary interface experiences a physical link failure (cable disconnection) or fails its configured Link Monitor health check targets, Fireware marks the Primary interface as inactive and automatically redirects all new outbound connections to the next highest-priority healthy interface in the backup list.
• Cascading Failover: If Backup 1 subsequently fails, traffic falls back to Backup 2. As long as at least one External interface in the list satisfies health checks, outbound connectivity is preserved.

4. Interface Overflow Mode

Interface Overflow mode is an advanced hybrid load-balancing strategy engineered for environments where secondary WAN connections have metered billing, data caps, or significantly higher latency (such as 4G/5G cellular modems, satellite uplinks, or metered MPLS links).

Operational Mechanics:

• Hierarchical Interface List: External interfaces are arranged in an ordered sequence: Primary interface, followed by one or more overflow interfaces.
• Bandwidth Threshold Configuration: The administrator configures a specific bandwidth threshold (in Kbps or Mbps) on the primary interface. This threshold represents the maximum sustained bandwidth capacity before overflow begins.
• Normal State: All outbound traffic passes through the primary interface until total outbound traffic volume reaches the configured bandwidth ceiling.
• Overflow State: When current traffic on the primary interface exceeds the configured threshold, Fireware keeps all existing connections on the primary interface but routes subsequent new outbound connections out the secondary overflow interface.
• Recovery and Normalization: When the aggregate bandwidth consumption on the primary interface drops back below its configured threshold, newly initiated outbound connections revert to using the primary interface once again. Existing connections on the overflow interface are permitted to complete naturally without abrupt termination.

---

Multi-WAN Operating Modes Comparison

The following table summarizes the fundamental characteristics, traffic distribution methods, and ideal deployment scenarios for each of the four Fireware Multi-WAN modes:

---

Sticky Connections & Session Integrity

While active-active load sharing in Round-Robin mode optimizes bandwidth utilization, it introduces a major networking challenge known as asymmetric egress addressing.

The Problem: Egress IP Asymmetry

When a Firebox routes traffic across multiple External interfaces, it performs Dynamic NAT (Source NAT) on outbound packets. Each External interface has a different public IP address assigned by its respective ISP:

• Traffic exiting Eth0 is translated to public IP 203.0.113.10.
• Traffic exiting Eth2 is translated to public IP 198.51.100.25.

Many modern secure web applications, online banking portals, electronic health record (EHR) systems, credit card processing gateways, and e-commerce carts maintain stateful application sessions tied directly to the client's public source IP address. If a user logs into their bank via Eth0 (IP 203.0.113.10), the remote banking server authenticates that session for 203.0.113.10.

If the user clicks to transfer funds, and Round-Robin dispatches that subsequent HTTPS connection through Eth2 (IP 198.51.100.25), the banking server sees an authenticated session suddenly originating from an entirely different IP address. Recognizing this as a potential session-hijacking attack, the banking server immediately terminates the user's session, forcing a re-login or locking the account.

[Internal Workstation] 
      │ (10.0.1.50)
      ▼
[Firebox Multi-WAN]
   ├── Request 1: Login ────────► Eth0 (NAT: 203.0.113.10) ──► [Banking Server: Session Created]
   │                                                                 ▲
   └── Request 2: Transfer (NO STICKY) ─► Eth2 (NAT: 198.51.100.25) ─┘ [REJECTED: IP Mismatch!]

The Solution: Sticky Connections Mechanism

To eliminate this session disruption, Fireware provides the Sticky Connections feature:

1. Hashing Algorithm: When Sticky Connections is enabled, the Firebox computes a deterministic cryptographic hash based on the Source IP Address and Destination IP Address of the outbound packet flow.
2. Interface Binding Cache: The resulting hash maps the client-to-destination conversation to a specific External interface and records this association in an internal Sticky Connection table.
3. Persistence Duration: For the duration of the configured Sticky Connection Timeout (configurable from 10 seconds to 86,400 seconds / 24 hours; default is 180 seconds / 3 minutes), any new outbound connection between that identical source IP and destination IP will be routed out the exact same External interface.
4. Timer Refresh: Each time a packet matches an existing entry in the Sticky Connection table, the timer for that entry is reset back to the full timeout duration. The association only expires when the connection remains completely idle for the entire duration of the configured timeout.

Exam Tip: Sticky Connections is enabled by default when Round-Robin or Interface Overflow mode is selected. The default timeout is 180 seconds (3 minutes). If users report intermittent logouts on sensitive cloud applications, increasing the Sticky Connection timeout is the recommended administrative remedy.

---

Policy-Level Routing Overrides

Although the global Multi-WAN setting defines the default behavior for all unclassified outbound traffic, administrators often require specific applications or critical subnets to deviate from the global rule. Fireware supports granular policy-level overrides that supersede the global Multi-WAN configuration.

Within the properties of any custom firewall policy (such as an HTTP-proxy, HTTPS-proxy, or custom packet filter), the administrator can navigate to the Route or SD-WAN tab and select an alternate egress method:

• Policy-Based Routing (PBR): Forces all traffic matching that specific policy to exit through a designated External interface, completely ignoring the global Multi-WAN Round-Robin or Failover mode.
• SD-WAN Actions: Binds the policy to a Software-Defined WAN action that monitors real-time line metrics (latency, jitter, packet loss) and selects optimal paths dynamically (detailed in Section 5.3).

By leveraging policy-level overrides, an organization can operate in global Round-Robin mode for general employee web browsing while strictly pinning guest Wi-Fi to a secondary broadband circuit and routing corporate finance traffic exclusively out a secure, static primary fiber connection.