topic Failover (Active, Standby) 2 WAN Tunnel IPSEC in General Topics

Failover (Active, Standby) 2 WAN Tunnel IPSEC

Chhayheng — Sun, 12 Mar 2017 10:29:59 GMT

Hi All Expert,

I have a small question to ask you.
I have plan to use PA for this semester and try to find what PA can do.

I have more than 10 Partners dial Site-to-Site VPN with me.
One of 10 Partners have connection issue with my primary link, so PA will switchover to secondary link to serve VPN to that partner.
Question:
1. When PA switchover to secondary link. Do partners who have no issue connection will switchover to secondary link as first partner(Partner who has issue on primary link) or not ?

Hope I get this answer ASAP.

Thank you

Re: Failover (Active, Standby) 2 WAN Tunnel IPSEC

santonic — Mon, 13 Mar 2017 07:29:55 GMT

No, automatically not.

But with the right configuration on PA (2 IPSECs for each partner and tunnel monitoring, or IPSEC confiuration independent on IP...) and something similar on the other gateway this can be achieved.

Re: Failover (Active, Standby) 2 WAN Tunnel IPSEC

Chhayheng — Mon, 13 Mar 2017 10:44:27 GMT

Hi Sir,

It meant that when all partners have 2 different public IP, we can maintain partners that have no issue connection on primary link and partners who have issue connection to secondary link right ? it is by aumotatically right ? Static route or Dynamic route ?

Best Regards,
Chhayheng

Re: Failover (Active, Standby) 2 WAN Tunnel IPSEC

pulukas — Sat, 01 Apr 2017 15:47:18 GMT

When you setup tunnel monitoring on the VPN, this runs a test on this specific VPN to determine if it is up and running correctly. When the test monitor fails that VPN alone is shut down. This will not affect your other partner VPN connections.

In other words, the test is not by the gateway address as a whole that all partners are connecting to, but a test of the specific VPN tunnel of each partner individually.

Re: Failover (Active, Standby) 2 WAN Tunnel IPSEC

OtakarKlier — Tue, 04 Apr 2017 15:57:59 GMT

Hello,

Would you be able to provide a basic diagram? I think this might be possible but would need to see the diagram to find out.

Regards,