Sophos Firewall

Discussions Automatic IPSec failover and failback between two XGs with two WAN ports each

Sophos Firewall requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 3 replies
Subscribers 37 subscribers
Views 2610 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Automatic IPSec failover and failback between two XGs with two WAN ports each

Piotr Szmyt over 4 years ago

Hello

According to XG Firewall v17.5 specification:

„VPN and SD-WAN Failover and Failback including new IPSec failover and failback controls and SD-WAN link failback options.”

Does it really works between two XGs with two WAN ports each ? - 4 variants of the IPSec list are theoretically possible:

XG1-WAN1 to XG2-WAN1

XG1-WAN1 to XG2-WAN2

XG1-WAN2 to XG2-WAN1

XG1-WAN2 to XG2-WAN2

Does it really works, automatic?

Best Regards Peter

This thread was automatically locked due to age.

Parents

0 MasterRoshi over 4 years ago

Hi Peter,

It does if configured correctly.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 MasterRoshi over 4 years ago

Hi Peter,

It does if configured correctly.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Piotr Szmyt over 4 years ago in reply to MasterRoshi

Hi MasterRoshi

OK. Thank you. I had just tested it between 2 XGs. It works.

According to

https://community.sophos.com/products/xg-firewall/f/vpn/109606/ipsec-vpn-failover-between-2-xg-with-both-2-wan-connections

To build Failover groups only on the Branch Office side - seems to be the best solution

Can you confirm this?

Peter
Cancel
Vote Up 0 Vote Down

Cancel
0 Piotr Szmyt over 4 years ago in reply to Piotr Szmyt

OK

Failover and Failback works. Now I test "route branch office internet traffic through the head office ISP gateway" via VPN IPSec connection

according to: https://community.sophos.com/kb/en-us/123261

In my XGs based police routing and internet traffic works only on primary site-to-site VPN IPSec connection. I had defined failover group on BO XG and 4 VPN IPSec connections between 2 XGs . Failover i Failback, after automatic switch to second or third VPN IPSec connection - works with communication between LANs but does not works internet traffic. Internet traffic works only on primary site-to-site connection...

Can you help me?

Thanks Peter.
Cancel
Vote Up 0 Vote Down

Cancel