MX Feature Request - Separate Firewall/SD-WAN Rules for WAN1 and WAN2

[NJNetworkGuy100]

Put this in as a Make a Wish, but wanted to see if this is something other folks would like to see...

A lot of our sites run fast fiber for WAN1 and a much slower coax/cellular/MG as the backup connection on WAN2.  

We'd love to be able to set different configurations for the Firewall/SD-WAN settings for WAN2 in case of a failover to the slower backup circuit.  Like blocking video streaming on just WAN2 or prioritizing different traffic or limiting client bandwidth on just the slower circuit.  

So, when the WAN failover automatically happens, all the firewall/SD-WAN settings are in place and ready to go for the backup circuit.  

Right now, we get the alert that the primary circuit is down, and we have to manually change the rules during the fiber's outage.  

[ww]

Would be nice  to have yes, in case of not using load balancing

For now you  could  speed it up  using the api.

Other option is  to change  the cellular firewall to use  for wan2 (need to contact support). But thats only L3 fw rules.

[NJNetworkGuy100]

We don't really use load balancing on our MX setups.  This is in case of an outage on our faster and steadier WAN1 fiber connection, and we are forced to send all office traffic over the slower (and more unpredictable) WAN2 connection.

We would just love to be able to set different Firewall/SD-WAN rules for each WAN connection when not using load balancing.  And then, when an outage occurs, the rules are already there ready to go.  And when WAN1 comes back up again, the firewall/SD-WAN rules automatically are back to what they should be.    

API scripting does help in automating some of this, but we still have to run the script manually.   

I had heard about that Cell Failover Firewall option for WAN2...but it limits things with it being only for Layer 3 rules.  

[NolanHerring · Accepted solution]

Just an FYI but if you contact support, you can have them make the 'cellular' firewall rules act as WAN2 firewall rules.

Not actually 100% sure if they function unless WAN2 is the active circuit, as I've only ever used WAN2 as a backup, and not messed with the load-balancing etc. Should be easy enough to test though, just use a <yourIP>/32 and point it to WAN2 and see if it does what you want etc.

I really wish they would break out the rules per interface all the way though.

[NJNetworkGuy100]

Yeah, I knew about making the "cell firewall rules" for WAN2, but it only affects the Layer3 rules.  Not the SD-Wan or Layer7 rules.  

Guess I can hope this a a roadmap feature.