1. If secospace server of line 1 was broken, turn on emergency channel to supply the access to certificated domains.
2. If line 3 was broken and policy-based routing of the core switch were fail, it wouldn’t be diverted traffic to SACG, so that accessing to certificated domains wouldn’t be affected.
3. If line 2 was broken, and the traffic is still diverted to SACG, SACG would become a routing black hole, and all services are interrupted.
Line 2 and line 3 can be configured to be a link-group to solve the problem as above.
[Eudemon] interface GE1/0/0
[ Eudemon-interface-GE1/0/0] link-group 1
[Eudemon] interface GE2/0/0
[ Eudemon-interface-GE2/0/0] link-group 1
Notice: Link-group means that several interfaces of a device are combined as a group. If an interface in the group was down, all interfaces in the group would be down. Link-group is only effective for FE and GE interface, not for other types of interfaces including sub-interface. And one interface only have one group.