Dual VPNs with Dual ISPs with a Single Firewall to a Remote Site

[S.ChakkiralaVenkata]

Dual isp with tunnels have been configured. primary isp is on eth0/1 and secondary is on eth0/5.

Tunnel monitoring has been configured on primary tunnel. when primary isp goes down tunnel traffic will be shifted to secondary isp tunnel.

Physically i have tested by removing primary isp at firewall, automatically all traffic get shifted to secondary tunnel and secondary isp ethernet as expected.

the concern what has been observed that during live isp failover. when primary isp goes down, still i have observed primary ethernet at firewall level showing status as up even enabled path monitoring . and tunnel shifting to secondary tunnel. and in the route forwarding table still i can see the gateway was reaching at primary isp only.

need the support the concern.

[OtakarKlier]

Hello,

All the UP status means is that the port sees a connection. I would recommend the monitor IP be at the remote site on the inside of the firewall, like its port. This way the port can still be up but the path will be down and should fail over properly.

Hope this helps.

Regards,