1. Service Level Agreement (SLA).
2. We likely did not configure DNS for the secondary WAN connection.
3. Failure to correctly configure the monitor IP for the secondary WAN; failure to create firewall rules or to change outbound NAT rules to send traffic to the gateway group.
4. We didn’t configure latency settings for the secondary WAN to allow for the greater amount of latency a satellite connection would have.
5. (a) Because policy-based routing does not work with traffic that originates with pfSense, like DNS traffic. (b) Make the upstream DNS server the monitor IP, and pfSense will create an implicit static route to it.
6. Enable State Killing on Gateway Failure.
7. (a) Set both to Tier 1. (b) Set one to Tier 1 and one to Tier 2.
8. (a) pfSense will think the gateway is up when it should be down. (b) The remote site’s administrator may interpret our pings an an attack and block them. When our pings fail, pfSense will mark the gateway as down.