This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to configure a failover IPSec VPN using Tunnel Interface with 4 Connections?

Hello,

I have the following situation, my Head Office has two ISP Wan links and the Branch Office also has two ISP Wan links and I want to configure a failover this way:

HO BO
ISP 1 ------ ISP1

ISP 1 ------ ISP2

ISP 2 ------ ISP1

ISP 2 ------ ISP2

So it is going to be 4 connections, when using site-to-site I just had to configure the Failover Group and inform the connections, but how does that work with Tunnel Interface and SD-WAN routing? Because on SD-WAN routing I can only specify the main gateway and a backup one.

Thanks

This thread was automatically locked due to age.

Top Replies

LuCar Toni over 3 years ago in reply to Sachin Bhatgare +2 verified

SD-WAN PBR Rule have a Monitoring service builtin (in the gateway). The Rule will only be used, if the gateway is reachable.

0 Rodrigo Silveira2 over 3 years ago

Anyone?
Cancel
Vote Up 0 Vote Down

Cancel
0 VAIS-Matt over 3 years ago in reply to Rodrigo Silveira2

Rodrigo Silveira2 Did you ever figure out an answer to this one? I've got a customer who is also having issues with their sites who all have 2 ISP's and automatic VPN failover.
Cancel
Vote Up 0 Vote Down

Cancel
0 Sachin Bhatgare over 3 years ago

Instead of an IPsec tunnel interface create a site to site IPsec VPN. In failover configuration, you can add all four links.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago

Shouldnt it be possible to keep all tunnels up at the same time? But in SD-WAN - Its correct, you can use 2 Interfaces at the same time. But you can create two rules behind each other. The Rule will fail, if all Gateways are down within the rule and XG will lookup another rule.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Sachin Bhatgare over 3 years ago in reply to LuCar Toni

If we do not configure failover, all the tunnels can be up at the same time. But it will of no use as the traffic will go through the first tunnel only.
Cancel
Vote Up 0 Vote Down

Cancel
+1 LuCar Toni over 3 years ago in reply to Sachin Bhatgare

SD-WAN PBR Rule have a Monitoring service builtin (in the gateway). The Rule will only be used, if the gateway is reachable.

__________________________________________________________________________________________________________________
Cancel
Vote Up +2 Vote Down

Cancel