This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Having Issues with Redundant IPSec S2S

Hi Folks,

Trying to set up a redundant IPsec s2s between 2 UTM's; however, I am having some trouble. Tropology is like this.
(initiating) Remote Site WAN1 + WAN2 ---> HQ-WAN1 (respond only)

I would like both tunnels to be up, but to only use WAN1 if WAN2 is down.

Can someone walk me through step by step on how I would configure this? I've tried using the wiki, tunnels would establish but traffic would not flow (using bind to the local interface) I think it might be the multipath rules I was using.

I will note, I'm quite happy to change this to red-tunnel s2s if I can achieve the same effect easier.

Thanks

This thread was automatically locked due to age.

0 DKKDG over 5 years ago

Hi xInsertx,

have you tried this here:
https://community.sophos.com/products/unified-threat-management/f/hardware-installation-up2date-licensing/80484/how-to-do-backup-vpn-with-sophos-utm-9-x-more-detailed-than-kb-118975/332719#332719

Here you can skip the external connection for the layer 2 connection.

Best Regards
DKKDG
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 5 years ago

An alternative to DKKDG's classic solution was proposed by Michael Klehr - Sophos UTM multiple S2S IPsec VPN mit Failover – Tutorial (DE). It's in German, but all of the screen shots are in English, so I think it should be understandable even if you don't speak German.

In essence, binding the IPsec Connection to an interface allows you to use Static Interface Routes or Multipath rules binding traffic to an interface. This "trick" makes the same thing possible that you could do with RED tunnels before. Depending on your hardware, you might be able to take advantage of Intel's AES-NI to speed throughput using AES GCM. Here's my preference:

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 xInsertx over 5 years ago in reply to BAlfson

Bob,

That is actually the guide I used as a reference. Tunnels were up, but I think something is going wrong at the multi-path part.

HQ:

Multi-Path: HQ-Net - Any - Remote-Net - WAN1

Remote:

Multi-Path: Remote-Net - Any - HQ-Net - InterfaceGroupWans

Interface Group: #1 WAN2, #2 WAN1

Both Interfaces are in "Uplink Balancing"

How i would kill for Ikev2 + BGP right about now...
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 5 years ago in reply to xInsertx

Please show pictures of the Edits of the Multipath rules on both sides.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel