Using IPSEC tunnel as redundant link to a destination

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Using IPSEC tunnel as redundant link to a destination

L3 Networker

Hello PAN Live Community,

I'm looking at having a redundant link to a given set of destination (servers) over an IPSEC tunnel when primary WAN link goes down.

What is the best way to do this ?

PBF ?

1 accepted solution

Accepted Solutions

Yes, once the PBF rule will be disabled when the primary link goes down, static route will take over immediately. But you need to have such static route for directing desired traffic into correct tunnel interface. 

 

View solution in original post

9 REPLIES 9

L6 Presenter

Ok, something is confusing: you have non-IPSEC connection to destination on primary WAN link and when that one goes down you want IPSEC connection to that destination on secondary WAN link? So backup connection will be more secure than primary connection?

 

But yes, PBF rules are for such scenarios. Or in case with tunnel interfaces you can also use tunnel monitor functionality.

Cyber Elite
Cyber Elite

yopu can set up a end to end IPSec tunnel on your secondary link and then have a pbf rule that directs all traffic to your primary link with a monitoring profile that disabled the pbf if the monitor fails, then have a static route (or a second pbf rule) direct traffic into the IPSec tunnel

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization


@santonic wrote:

Ok, something is confusing: you have non-IPSEC connection to destination on primary WAN link and when that one goes down you want IPSEC connection to that destination on secondary WAN link? So backup connection will be more secure than primary connection?

 

But yes, PBF rules are for such scenarios. Or in case with tunnel interfaces you can also use tunnel monitor functionality.


 

IPSEC tunnel to that destination over Internet for backup.. not WAN link.

So it's for connectivity sake.. not security sake.


@reaper wrote:

yopu can set up a end to end IPSec tunnel on your secondary link and then have a pbf rule that directs all traffic to your primary link with a monitoring profile that disabled the pbf if the monitor fails, then have a static route (or a second pbf rule) direct traffic into the IPSec tunnel


 

If I disable the pbf when primary/WAN link goes down (via monitor configuration), won't the IPSEC site-to-site then immediately take over (without any configuration/traffic engineering such employing another pbf or static route) as that route will be the only available/remaining in the routing table for the given destination networks ?

Yes, once the PBF rule will be disabled when the primary link goes down, static route will take over immediately. But you need to have such static route for directing desired traffic into correct tunnel interface. 

 

 


@santonic wrote:

Yes, once the PBF rule will be disabled when the primary link goes down, static route will take over immediately. But you need to have such static route for directing desired traffic into correct tunnel interface. 

 


Makes sense.. Thanks so much !

Or... even easier.. not do a PBF.. and just do a floating static (influence administrative distance) over the IPSec site-to-site... ?

 

 

Yes, bu what will make primary route be deleted? You can lose connectivity but interface status remains up. 


@santonic wrote:

Yes, bu what will make primary route be deleted? You can lose connectivity but interface status remains up. 


Understood.. given the fault scenario and permutations/combinations of fault.

Floating static alone might be enough.. and in other scenario's monitoring on a PBF might be needed.

 

I have enough to build my traffic engineering anyhow.. Thanks all.

  • 1 accepted solution
  • 3926 Views
  • 9 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!