Question: We are experiencing an issue with our SonicWall NSA 2400 Firewall. We have a secondary gateway over IPSec setup in the event of a failure of our main ISP (which is unfortunately common). The secondary gateway is a 4G connection through Verizon and the cost grows as data usage increases.

The firewall switches over to the secondary gateway properly, but then *sometimes* will not renegotiate and switch back to the primary when it comes back up. Hitting 'Renegotiate' on both sides seems to fix the issue, but I am wondering if there is something I am missing that may be causing it to stay on the secondary.

I don't think this has anything to do with the settings as it seems to work 50% of the time, but here they are anyway in case someone has some tips on how to ensure switching back to primary when the connection is restored.

Policy Type: Site to Site

Auth Method: IKE using Preshared Secret

IKE Phase 1 proposal:

Exchange: Main Mode

DH Group: Group 1

Encrypt: AES-256

Auth: SHA1

Lifetime: 3600 (seconds)

Phase 2 proposal:

Protocol: ESP

Encrypt: AES-256

Auth: SHA1

Lifetime: 900 (seconds)

Keep Alive is enabled, and Preempt Secondary Gateway is enabled at 120 second interval.

Answer: 
You will get a "Back-end server is at capacity" when the ELB load balancer performs its health checks and receives a "page not found" (or other simple error) due to a mis-configuration (typically with the NameVirtual host).

Try grepping the log files folder using the "ELB-HealthChecker" user agent. e.g. 

```
grep ELB-HealthChecker  /var/log/httpd/*

```

This will typically give you a 4x or 5x error which is easily fixed. e.g. Flooding, MaxClients etc is giving the problem way too much credit.

FYI Amazon: Why not show the returned response from request? Even a status code would help.
you can up the values of the elb health checker, so as a single slow response wont pull a server from elb. better to have a few users get service unavailable, than the site being down for everyone.

EDIT: We are able to get away without pre-warming cache by upping health check timeout to 25 seconds......after 1-2 minutes... site is responsive as hell

EDIT:: just launch a bunch of on demand, and when your monitoring tools shows management just how fast your are, then just prepay RI amazon :P

EDIT: it is possible, a single backend elb registered instance is not enough. just launch a few more, and register them with elb, and that will help you narrow down your problem