topic Re: Using IPSEC tunnel as redundant link to a destination in General Topics

Using IPSEC tunnel as redundant link to a destination

mpgioia — Mon, 11 Apr 2016 23:26:17 GMT

Hello PAN Live Community,

I'm looking at having a redundant link to a given set of destination (servers) over an IPSEC tunnel when primary WAN link goes down.

What is the best way to do this ?

PBF ?

Re: Using IPSEC tunnel as redundant link to a destination

santonic — Tue, 12 Apr 2016 09:24:52 GMT

Ok, something is confusing: you have non-IPSEC connection to destination on primary WAN link and when that one goes down you want IPSEC connection to that destination on secondary WAN link? So backup connection will be more secure than primary connection?

But yes, PBF rules are for such scenarios. Or in case with tunnel interfaces you can also use tunnel monitor functionality.

Re: Using IPSEC tunnel as redundant link to a destination

reaper — Tue, 12 Apr 2016 10:25:56 GMT

yopu can set up a end to end IPSec tunnel on your secondary link and then have a pbf rule that directs all traffic to your primary link with a monitoring profile that disabled the pbf if the monitor fails, then have a static route (or a second pbf rule) direct traffic into the IPSec tunnel

Re: Using IPSEC tunnel as redundant link to a destination

mpgioia — Tue, 12 Apr 2016 12:28:14 GMT

@santonic wrote:

Ok, something is confusing: you have non-IPSEC connection to destination on primary WAN link and when that one goes down you want IPSEC connection to that destination on secondary WAN link? So backup connection will be more secure than primary connection?

But yes, PBF rules are for such scenarios. Or in case with tunnel interfaces you can also use tunnel monitor functionality.

IPSEC tunnel to that destination over Internet for backup.. not WAN link.

So it's for connectivity sake.. not security sake.

Re: Using IPSEC tunnel as redundant link to a destination

mpgioia — Tue, 12 Apr 2016 12:30:59 GMT

@reaper wrote:

yopu can set up a end to end IPSec tunnel on your secondary link and then have a pbf rule that directs all traffic to your primary link with a monitoring profile that disabled the pbf if the monitor fails, then have a static route (or a second pbf rule) direct traffic into the IPSec tunnel

If I disable the pbf when primary/WAN link goes down (via monitor configuration), won't the IPSEC site-to-site then immediately take over (without any configuration/traffic engineering such employing another pbf or static route) as that route will be the only available/remaining in the routing table for the given destination networks ?

Re: Using IPSEC tunnel as redundant link to a destination

santonic — Tue, 12 Apr 2016 13:19:34 GMT

Yes, once the PBF rule will be disabled when the primary link goes down, static route will take over immediately. But you need to have such static route for directing desired traffic into correct tunnel interface.

Re: Using IPSEC tunnel as redundant link to a destination

mpgioia — Tue, 12 Apr 2016 13:39:13 GMT

@santonic wrote:

Yes, once the PBF rule will be disabled when the primary link goes down, static route will take over immediately. But you need to have such static route for directing desired traffic into correct tunnel interface.

Makes sense.. Thanks so much !

Re: Using IPSEC tunnel as redundant link to a destination

mpgioia — Tue, 12 Apr 2016 13:43:39 GMT

Or... even easier.. not do a PBF.. and just do a floating static (influence administrative distance) over the IPSec site-to-site... ?

Re: Using IPSEC tunnel as redundant link to a destination

santonic — Wed, 13 Apr 2016 06:09:00 GMT

Yes, bu what will make primary route be deleted? You can lose connectivity but interface status remains up.

Re: Using IPSEC tunnel as redundant link to a destination

mpgioia — Wed, 13 Apr 2016 06:18:33 GMT

@santonic wrote:

Yes, bu what will make primary route be deleted? You can lose connectivity but interface status remains up.

Understood.. given the fault scenario and permutations/combinations of fault.

Floating static alone might be enough.. and in other scenario's monitoring on a PBF might be needed.

I have enough to build my traffic engineering anyhow.. Thanks all.