Routes

Virtual Network Routes

Routes defined a the virtual network level allow creating a global route table shared with all nodes and clusters attached to the virtual network. This table is then used to evaluate where to send VPN traffic for a specified destination CIDR.

Route Fields

A Route has the following fields:

Managing Virtual Network Routes

Adding Virtual Network Routes

1. Navigate to Domain > Virtual Networks and select the desired Virtual Network.
2. The Routes table is selected by default

   

   Tip: Use the search field to filter the list of routes so you can see the routes you are adding. You could filter by the CIDR address or part of the destination node/cluster names. This will show any existing matching routes, and will make it easy to see the new routes you are adding.
3. Click the add route button.

   

4. Provide the desired route information in the fields
   1. Select the destination cluster or node
   2. Enter the destination network in CIDR notation. For a single IP use /32.
   3. Enter a metric between 1 and 200.
   4. Optionally, provide a description.

   

5. Repeat the above two steps for any additional routes you wish to add.
6. Click the Save button.

   

7. There should be a notification saying “Routes Updated” but you will need to review and apply changes before the changes are actually be published to nodes in your environment.

   

Deleting Virtual Network Routes

1. Navigate to Domain > Virtual Networks and select the desired Virtual Network.
2. The Routes table is selected by default

   

3. Use the search field to filter the list of routes.
   You could filter by the CIDR address or part of the destination node/cluster names. This will show any existing matching routes, and will make it easy to see the new routes so you can delete them.
4. Click the red X on the far right of the route being removed.

   

5. Repeat the above two steps for any additional routes you wish to add.
6. Click the Save button.

   

7. There should be a notification saying “Routes Updated” but you will need to review and apply changes before the changes are actually be published to nodes in your environment.

   

Route Failover 

Route failover allows a subnet to be routed to an alternate node or cluster in the event of a failure.  This can be automatic or performed manually.

Prerequisites 

In either configuration, the virtual network settings under VPN settings for the primary and backup destination nodes/clusters must match. Including:

• Network Virtual Route

  

• Network Group under Outside NAT Table

  

• Virtual CIDR under Inside NAT Table

  

Automatic Failover

To have the route failover without manual intervention you must define two routes for the same subnet (Destination CIDR) with different metrics.  The lowest numerical metric will take precedence unless the destination node or cluster is offline.

In the below example configuration we want traffic for the 10.20.0.0/24 network to the edge cluster first, and failover to the edge-dr cluster.

Preventing Automated Failback or Forcing a Failover

As mentioned above if multiple routes are configured traffic will route to destination with the lowest metric number. So if the primary destination fails but then comes back online traffic will be routed back automatically.

However, there are some circumstances where this is not desirable. For example, if the primary site is unstable you may wish to keep traffic at the backup site until the primary is stabilized. Alternately, you may wish to preemptively reroute traffic to the backup site in advance of planned maintenance at the primary site.

To preemptively reroute traffic to the backup site, update the backup route to have a lower metric than the primary route.

Route Monitors

Route monitors can also be configured on virtual network routes. Domain-level support for route monitors was added in the June 2025 cloud release.

Route monitors at the domain level use the same monitor settings available on node or cluster static routes:

• ICMP or TCP monitoring
• destination IP
• destination port for TCP monitors
• monitor interval
• failures count
• optional maximum latency

Important Domain Workflow Difference

On domain routes, route monitor changes are staged with the route change set. After adding, updating, or deleting route monitors you must still save the route changes and then review and apply changes before the updated monitor configuration is published to nodes.

Notes

• Route monitor traffic still runs from the node or cluster that owns the route after the domain changes are published.
• If the node does not have the required virtual network connectivity or a usable virtual management IP, the monitor may not behave as expected.
• If you have multiple routes for the same destination CIDR, route monitors affect which routes are considered available for traffic.

For monitor behavior, limitations, and recommendations, see Route Monitor Best Practices.

Manual Failover

In some circumstances, it may be preferable for failover to only occur with manual intervention. In this situation, you will have a single route under the domain.  To initiate a failover you’ll need to update the destination cluster/node.

1. Login to the Portal and select your domain.
2. Click the link to the desired domain under the “Name” column.
3. Scroll down to the “Virtual Networks” section and select the “Routes” tab.
4. Find the route you wish to failover.
5. Update the destination device. (e.g. in the below you would switch from edge to edge-dr).
6. Click save.