Gateway Client Settings

Configure client settings

  6 minute read  

Settings on this page determine how a node’s client connection to gateway peers behave.

Settings

screenshot of gateway client settings
Gateway Client settings
Field NameDescription
Connectivity to Public GatewaysOptions are Allowed or Denied. If set to Denied this will cause the node to not attempt connections to public gateways. This might be desired if you want the node to only connect to configured private gateways. Or if you have private gateways that do not need to connect to the public gateways in your organization.

Hop Monitoring Settings

screenshot of gateway client hop monitor settings
Gateway Hop Monitoring settings
Field NameDescription
Monitor Hops to Gateway Servers

Determines if the node will attempt to monitor hops to gateway peers. The possible values are:

  • Always - The node will attempt to monitor hops to all gateway peers.
  • Only when peer requests - The node will only attempt to monitor hops to gateway peers that request it. This is the default state.
  • Never - The node will never attempt to monitor hops to gateway peers, even if peers request it.
Monitor Hops Protocol

The protocol used to probe each hop. Requires the June 2026 release or later.

  • SYN - Probes using TCP SYN packets, reusing the gateway’s TCP port so traffic already allowed out to the gateway is allowed for monitoring. This is the default and is the method prior versions used.
  • ICMP - Probes using ICMP. Both the edge and gateway must allow the traffic. ICMP makes it easier to detect a lower-than-expected MTU along the path.
  • SACK - Builds a full TCP session and sends 1-byte TCP packets within it until it gets a response, then closes the session. This helps on paths where network devices do not handle bare SYN traces well.
Monitor Hops IntervalThe interval time, in seconds, between gathering hop monitoring data. Default is 20s.
Support Monitor Hops Resets

Determines if the node will send reset (RST) packets for the TCP connections it attempts. Doing so reduces, but does not eliminate the number of resets seen on the WAN interface.

  • Enabled - The node will send reset packets. This is the default state.
  • Disabled - The node will not send reset packets.
Monitor Hops SYN Payload SizeDetermines the size of the TCP SYN payload sent. By default the payload is 0. Can be set between 0 and 1440. Recommended max is the lower of 1440 or the WAN MTU minus 60 bytes.

Gateway Latency Monitors

A gateway latency monitor watches the round trip time (RTT) of the node’s tunnel to a gateway and reacts when it exceeds a threshold. RTT is the time a packet takes to travel to the gateway and back.

A monitor does two separate jobs. It always reports, and it optionally participates in the node’s health.

Every time a monitor triggers or recovers, the node sends a Gateway Latency Exceeded event. This happens on every monitor no matter how Failure Mode and Critical are set. It fires on the transition only, so sustained high latency does not repeat the event.

Separately, a monitor marked Critical takes part in the node’s health decision. When enough critical monitors are triggered, the node marks itself unhealthy. For a cluster member that fails traffic over to a healthier member. On a standalone node the health change does not move traffic. A monitor that is not marked Critical never affects node health.

Gateway Latency Monitors settings with a Failure Mode and a table of monitors
Gateway Latency Monitors

Failure Mode

Determines how many triggered Critical monitors it takes to mark the node unhealthy. Monitors that are not marked Critical are not counted.

  • None - Gateway latency never marks the node unhealthy. Monitors still send events. This is the default.
  • Any - The node is marked unhealthy when any critical monitor is triggered.
  • All - The node is marked unhealthy only when every critical monitor is triggered at the same time.

Under Any and All, the node becomes healthy again once every critical monitor has recovered.

Monitor Fields

Use Add Latency Monitor to add a monitor.

Field NameDescription
Gateway NodeThe gateway to monitor latency to.
Gateway Path(Optional) A specific gateway path to use for the monitor. Configure this if you want to monitor latency over a second path.
Max LatencyThe maximum acceptable latency, in milliseconds, for the monitor.
Trigger CountThe number of consecutive RTT values that must be above the Max Latency before the monitor triggers.
Recover CountThe number of consecutive RTT values that must be below the Max Latency before the monitor marks itself healthy again.
CriticalWhen enabled, this monitor participates in the node’s health decision according to the Failure Mode setting. When disabled, the monitor still sends events but never marks the node unhealthy.

Gateway Paths

Allows you to define alternate paths to a gateway server

Field NameDescription
Status
  • Enabled - The node will attempt to build and utilize the additional path.
  • Disabled - The node will not build the additional path.
NameA name for the path.
Gateway NodeGateway for which the path is applicable.
Host IPDestination IP address for the path.
Host PortDestination port for the path.
Local IPUse this local IP as the source IP for the connection to the gateway.
Use as Default
  • True - Will not attempt to connect to the configured Gateway Node using the WAN interface IP and Default Gateway path.
  • False - Will attempt to connect to the Gateway node using both this defined path and the WAN Interface IP and Default Gateway path.
Screenshot of the gateway paths table
Example Gateway Path

Add A Gateway Path

  1. Click the Add Path link
  2. Fill in the fields as desired.
  3. Click the green check mark to save the path.
  4. Optionally, repeat with additional paths.
  5. Click save.

Delete a Gateway Path

  1. Click the X to the right of the desired path.
  2. Click save.