Fail-over VPN site-to-site

L4 Transporter

Re: Fail-over VPN site-to-site


Hi @jesuscano,


We have similar setup (IPsec failover to secondary tunnel) for two different firewall deployments. Both are on 8.1.x, but the first one was configured back when the FW was still on 7.1.x


I would say that your configuration seems OK - indeed you don't really need policy based routing (I still don't understand why there are instructions for doing such...). As @LukeBullimore mentioned the tunnel monitor will "disable", or bring down the logical tunnel interface, after that is is pure networking - any static routes assosiated with interface in down state will be removed from the FIB - there are still in RIB since they are static, but they are not active so they are not used to forward traffic.


The biggest "gotcha" with tunnel monitor is the encryption domain (proxy-IDs). I learned this through the hard way - If your tunnel is configured with multiple proxy IDs, FW will try to send pings to each of them. But in order for the pings to be successful your source and destination needs to match the proxy ID (interesting traffic needs to match the phase2 SAs)


For example:

ProxyID: local - remote
tunnel.1 IP - - tunnel monitor destination

The config above will work since you have only one ProxyID which is matching the source and destination addresses of the ping packet.


But if you have:

ProxyID-1: local - remote

ProxyID-2: local - remote
tunnel.1 IP - - tunnel monitor destination


Here tunnel monitor will report that this tunnel is down. The reason for that is the FW will try to send ping for both proxy-IDs. Pings will success for the first one, but will fail for second proxy ID, because the destination is not matching the remote encrpytion. And all static routes assosiated with this tunnel will be inactive (not installed in the FIB)


So I would suggest to double check if the firewall is still believing that main tunnel is down:

- Under the GUI check tunnel status (the far right icon under IPsec Tunnels)

- Under GUI check statistics for tunnel monitor - show vpn flow name <name if your tunnel >

- If you have multiple proxy-id configured run above command for each proxy-id



L4 Transporter

Re: Fail-over VPN site-to-site

We dont use proxyIds. Its blank.

L4 Transporter

Re: Fail-over VPN site-to-site

What is the output of the commad:


> show vpn flow name <name of your tunnel>


Do you see statistics for the monitor? What are they showing?

L3 Networker

Re: Fail-over VPN site-to-site

Hi @jesuscano,


This is what i feel, i feel you may face little trouble with this configuration

You have a default route through tunnel and have a tunnel monitoring with fail over in primary and wait-recover in secondary.

and if you dont have a static route to remote peers other that through tunnel,

consider following scenarios

1- primary tunnel-monitor  is up - everything works you wont face any issues,

2 - primary tunnel monitor is down - it makes tunnel disable and removes the route, second tunnel will become up and will have a default route through secondary tunnel. as you may not have a static route other than this to remote peer, primary monitoring might be keep on trying to rekey through seconday tunnel which may not be successful. what if your secondary tunnel aldo down now, as you have default monitoring(wait-recover), this tunnel will try to recover and route will be still there.


So i feel you should add a static route to remote peers not through tunnel, and no need of tunnel monitor in secondary as if first one succesfully rekeys, it will add a lower metric route.


L4 Transporter

Re: Fail-over VPN site-to-site



From the screenshots in the original post you can see his routes through the tunnels are not default routes.



L0 Member

Re: Fail-over VPN site-to-site

Hi @AlexanderAstardzhiev 


We have the same problem with failover VPN. We have 6 proxy IDs in the tunnel and the primary ipsec tunnel drops. You explained why it drops and now I am interested if you have maybe any solution for that problem?



L4 Transporter

Re: Fail-over VPN site-to-site

Hi @LukaPecher,


My solution was to split the proxy-id into separate IPsec tunnel configuration. It may sound very confusing, so I will try to explain it as clear as possible:

- You will need four ipsec tunnel - two tunnel to primary remote peer and two tunnel to secondary remote peer

- First two tunnels must be assigned with same tunnel interface (let say tunnel.1) and same IKE gateway (remote peer)

- Second two tunnels also must be assigned to same tunnel interface - tunnel.2 and same remote peer


- First primary tunnel will be configure with tunnel monitor enabled and with only one proxy-id that match the source and dest of the monitor

- Second primary tunnel will be configured with tunnel monitor disabled and with as many proxy-id as you like/need, excluding the proxy-id configured in the first primary


Identical you need to configure the second two tunnels to the secondary remote peer.


So under Network > IPsec Tunnels you should have something like that:



That way the tunnel monitor will send pings only via the correct proxy-id.

If the pings fail (for what ever reason), tunnel monitor will bring the logical tunnel interface. And because we are using the same tunnel interface for the second tunnel (to the primary peer without monitor), all the routes to tunnel.1 will be remove from FIB and traffic wil be redirected to secondary tunnel.



Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!