topic Re: All traffic through LSVPN (or LSVPN route metric) in General Topics

All traffic through LSVPN (or LSVPN route metric)

santonic — Fri, 06 Sep 2019 11:24:22 GMT

I want all satellites to route all traffic through VPN tunnel when it's available. In GP gateway if I leave Access Routes emtpy or if I publish 0.0.0.0/0 to the satellite I get the default route with metric 100 on the atellite. But that means the static default route entered on initial configuration of satellite will still remain the active route in forwarding table. And if we change metric on static default route (to more than 100) I guess the satellite will lose connectivity with GW gateway over outside interface?

Anyone played with this scenario of routing all traffic from satellites? I guess I could add 2nd virtual router on satellites but seems overkill just for this.

Re: All traffic through LSVPN (or LSVPN route metric)

OtakarKlier — Fri, 06 Sep 2019 16:52:07 GMT

Hello,

While i dont use LSVPN, why would it need an initial route? Shouldnt it just get them when you connect?

Regards,

Re: All traffic through LSVPN (or LSVPN route metric)

santonic — Mon, 09 Sep 2019 08:26:35 GMT

I meant the initital default route for the remote location to get internet access and establish LSVPN connection to the gateway. After that the idea is to route all user traffic including internet traffic through VPN.

Re: All traffic through LSVPN (or LSVPN route metric)

BatD — Mon, 09 Sep 2019 08:35:29 GMT

@santonic Do you really need static default routes on the firewall? Teh filrewall will only need to know the address of the IPs of the Portal and the Gateways, so maybe you can configure these with static roues.

Another option is to use PBF for forc all client traffic over the tunnel, which keeping your default static route on the firewall.

Re: All traffic through LSVPN (or LSVPN route metric)

santonic — Mon, 09 Sep 2019 08:45:44 GMT

Yeah, only specific static routes (to, GW, Portal, maybe updates...) would work if the customer doesn't want backup default route over internet in case there are issues with VPN.

And yeah, PBF is another way to go. Tho I think i would prefer the solution with 2 VRs.

Thanx for your feedback.

Re: All traffic through LSVPN (or LSVPN route metric)

JonasC — Thu, 26 Sep 2019 05:47:59 GMT

use 2 VR one pointing to your tunnel and one going to the internet, this works for us perfectly

Re: All traffic through LSVPN (or LSVPN route metric)

santonic — Mon, 30 Sep 2019 09:46:25 GMT

Yeah, in the end I went for 2 VR option as well and it works well.