UTM2UTM RED redundancy

Hallo Ronny,

At first, I thought this might work with with Uplink Balancing and Multipath rules with two (four?) RED tunnels - have you tried that?  A1-B1, A2-B1, A1-B2, A2-B2?  Don't know how much overhead it adds with each additional tunnel.

Thomas Friedrich's suggestion to use OSPF is one I like.  You can get an idea of how to do this in Sophos UTM multiple S2S IPsec VPN mit Failover – Tutorial (DE) - I know the fact that it's in German will not be a problem for you.

It just seems like there is an elegant way to solve this problem if only we can put our finger on it.

Cheers - Bob

Hallo Ronny,

At first, I thought this might work with with Uplink Balancing and Multipath rules with two (four?) RED tunnels - have you tried that?  A1-B1, A2-B1, A1-B2, A2-B2?  Don't know how much overhead it adds with each additional tunnel.

Thomas Friedrich's suggestion to use OSPF is one I like.  You can get an idea of how to do this in Sophos UTM multiple S2S IPsec VPN mit Failover – Tutorial (DE) - I know the fact that it's in German will not be a problem for you.

It just seems like there is an elegant way to solve this problem if only we can put our finger on it.

Cheers - Bob

Hi Bob

As usual, thank you for your insight. Uplink Balancing will not probably not work for us, as the REDs are site2site connections and not used for Internet access. I also tried LAGging them, but that doesn't work for virtual interfaces.

So OSPF seems to be the only option right now, as Thomas suggested too and I had this as a fall back on my list. As I stated before, I would very much prefer the UTM to have a "alternate IP/Host" setting for the RED client, but - very unfortunately - I do not see this coming.

Yours,

Ronny

Hi Bob

Well, not so much good news about that yet.

Tunnel 1 from FW A to FW B (IP 1) created and up.

Tunnel 2 form FW A to FW B (iP 2) created and up.

Tunnel 3 from FW B to FW A created leads to a disconnect of Tunnel 1 and 2, because the connection between both firewalls has already been established. Tunnel 3 will disconnect too, in an endless loop.

So it looks like you cannot have a RED tunnel from FW A to FW B and FW B to FW A.

I tried to bind the Host definition of FW A on FW B to each interface and create two tunnels to FW A, works great, but ignores the interface binding. When I bring down IP 2 the second tunnel still connects via IP 1. When I bring down IP 1 both tunnels die.

...

Hi Ronny,

your intent to have two reds in site one and two reds in site to initiate the connections from both sites? Two Datacenters with Servers?

You have to work with multipath rules on the RED Client Firewall to control the flow of the RED Traffic through the two or more IPs.

Check the "Skip rule on interface error" in the rules.

I defined RED Traffic in a Group, containing two members:

Kind regards,

Alex

Hi Alex

Very interesting, I will give it a try and get back to you.

The real intent is to be able to fail-over when one of the ISP links goes down, which for the client is not a problem, but for the server is, as we cannot specify two IP addresses on the client UTM.

Yours,

Ronny

Implement the logic layout among the physical, i.e. if you have one client sonnection IP and two server connection IPs create two RED Tunnels. If you have two or more client connections there will be four RED Tunnels and Multipathing Rules, if you like to have every case implemented. The Multipathing rule is needed on the client side, since this one sends traffic to the server and has to decide over which connection the packets flow.

Since client connections starts, when you activate them (without having traffic on the Interface), there's no need to implement a RED Server in a client Site.

Hi Alex,

more updates. I enabled uplink balancing and two multi path rules, as you suggested. One RED client connection to the other side is configured. Both ISP links are up and I have configured both as active in the balancing configuration, making ISP 1 the first in the list and ISP 2 the second. Now when I create the RED, it uses ISP 2, as this has the better BGP routing info at the moment.

But I cannot get the RED tunnel to bind to a certain interface. So when I create a second tunnel, it will use the same source IP and therefore the same ISP uplink as the other one. If the ISP fails, it falls over both to the other ISP. Something is still missing there. I tried the idea of Bob to use a different target host definition for both tunnels, each bound to an interface, but that doesn't work.

What am I missing?

Connecting to two different IP addresses on the target firewall work fine, by using OSPF.

Hi Ronny,

to get it: You have two links at your client side and two links at your server side, which are all active? You are able to connect to all of your IPs? You mentioned BGB -> You get a subnet via BGP distributed over two different providers/lines? To which IPs do you connect?

How's your configuration of the multipath rules? In my screenshot were two black fields in every of the rules. The first field defines the target IP (External Interface IP) to which the RED Tunnel should connect. The second one is the Interface, to which the connection should be bound.

Hi Alex,

sorry for all the confusion. Current setup is as follows:

FW A: one ISP uplink, RED server (plan to upgrade to second ISP link later this month)

FW B: two ISP uplinks, BGP full table, RED client

internal routing is all done via OSPF, BGP is only used externally (we advertise our own PI networks behind the FWs)

RED client is connecting to the external IP of FW A (which is provided in a transfer network from the ISP)

FW B also has two transfer networks, one for each ISP

This is the FW B setup:

Ah, now i got it...

Do you have another external IP on your Server UTM, since you cannot diffentiate the RED Traffic? In my example i have two Server IPs via two lines.

which UTM, the client UTM or the server UTM?

Edit: ahh wait, you asked for server UTM. I could use one of the additional address from the transfer network, didn't think about that. Nice one :) Thanks, I will try it tomorrow and give an update.