IPsec VPN Failover Groups between two firewalls

Hi SI Braveo

Please re-check the Head and Branch office configuration as per the kb below 

Sophos Firewall: Configure an IPsec VPN failover with multiple connections 

Regards

I've seen the same behaviour in having a failover group at each end (because you would like have preferred interfaces in use when you can plus the KB articles say you) - the tunnels have a mad 5-10 minutes where all the links cycle in a panic (or sometimes just collapse in a heap). It's very poor at recovering after a reboot, so I'd say your experience was typical.

A single FO group seems to work fine but I've only tried that where it's a remote site with 2 links going to central site with one and there's no choice...

Regards

I personally am not a fan of failover groups, and avoid them if I can.  We configure route-based VPNs, and then tune the routing to prioritize which paths are preferred.  The beauty of this is, all the tunnels are up all the time.

Thanks. I'm double checking everything to be sure I didn't miss anything.

Thanks for the reply.

Yeah, I tried to leave only the branch office's FO group enabled and it seemed to work OK.

For now I'm just gonna leave it that way until I can switch to some sort of route-based VPN with SD-WAN rules, like suggested by another poster.

Regards

Thanks for the suggestion.

I'm reading a little bit on route-based VPNs with SD-WAN rules, and it does seem like the best option. Not having a bunch of red VPN icons sure is very enticing...