OK, let's take care of he easy part first.
Any time you see a log entry for Default_Access_Rule, that means that you have received traffic which violated an access rule. In normal circumstances, you don't need to manually create or adjust access rules, the automatic access rules allow traffic matching your interface networks, which is usually all you need. In this case since the destination interface and network look like they make sense (but check my work, I can't see everything, you can), I have to ask does y.y.y.152 match your LAN or any of your interface IPs? The most usual reason to see these log entries is because you are trying to use the same network on multiple interfaces, are you?
Now, for failover (which is distinct from load balancing [I assume that is what all the LBs mean]), you are going to need to manually create all your default routes (routes to all-nets), and ensure they have monitoring enabled with settings that make sense. Assuming your IP Rules are good, monitoring is all you need to do for failover.
For load balancing, the process is very similar, but there are some gotchas to look after. Load balancing only works on routing tables that have multiple routes with the same destination, and metric. In other words, any routing tables which you wish to load balance need to have all their default routes on the same metric. After that is squared away, create a load balancing instance (and trust me when I say that happy endings happen almost exclusively with the load balance method of "destination").
For simple failover or load balancing, those paragraphs are all you need on the routing side, the policy (IP Rule) side is fairly intuitive, but make sure what you have makes sense.
Get failover or balancing working before you make things more complicated by adding a routing table and routing rules for particular traffic classes, by themselves neither failover nor balancing require additional routing tables. Once you are ready for a second routing table, try to keep it to just the one additional table, if you think about it, you only have 2 paths to route, you should only need 2 tables to hold those paths.
If we need to go any further with routing troubleshooting, you should always use the current routing table from status->routes, as it will show you what the DFL is currently using to route (including things like dynamically added routes and route monitoring).
Author
Topic: DFL-800 multiple External IP on WAN2 to DMZ or/and LAN (Read 6301 times)