Using IPSEC tunnel as redundant link to a destination

[mpgioia]

Hello PAN Live Community,

I'm looking at having a redundant link to a given set of destination (servers) over an IPSEC tunnel when primary WAN link goes down.

What is the best way to do this ?

PBF ?

[santonic]

Ok, something is confusing: you have non-IPSEC connection to destination on primary WAN link and when that one goes down you want IPSEC connection to that destination on secondary WAN link? So backup connection will be more secure than primary connection?

But yes, PBF rules are for such scenarios. Or in case with tunnel interfaces you can also use tunnel monitor functionality.

[reaper]

yopu can set up a end to end IPSec tunnel on your secondary link and then have a pbf rule that directs all traffic to your primary link with a monitoring profile that disabled the pbf if the monitor fails, then have a static route (or a second pbf rule) direct traffic into the IPSec tunnel

[mpgioia]

---

@santonic wrote:

Ok, something is confusing: you have non-IPSEC connection to destination on primary WAN link and when that one goes down you want IPSEC connection to that destination on secondary WAN link? So backup connection will be more secure than primary connection?

But yes, PBF rules are for such scenarios. Or in case with tunnel interfaces you can also use tunnel monitor functionality.

---

IPSEC tunnel to that destination over Internet for backup.. not WAN link.

So it's for connectivity sake.. not security sake.

[mpgioia]

---

@reaper wrote:

yopu can set up a end to end IPSec tunnel on your secondary link and then have a pbf rule that directs all traffic to your primary link with a monitoring profile that disabled the pbf if the monitor fails, then have a static route (or a second pbf rule) direct traffic into the IPSec tunnel

---

If I disable the pbf when primary/WAN link goes down (via monitor configuration), won't the IPSEC site-to-site then immediately take over (without any configuration/traffic engineering such employing another pbf or static route) as that route will be the only available/remaining in the routing table for the given destination networks ?

[santonic · Accepted solution]

Yes, once the PBF rule will be disabled when the primary link goes down, static route will take over immediately. But you need to have such static route for directing desired traffic into correct tunnel interface. 

[mpgioia]

---

@santonic wrote:

Yes, once the PBF rule will be disabled when the primary link goes down, static route will take over immediately. But you need to have such static route for directing desired traffic into correct tunnel interface. 

---

Makes sense.. Thanks so much !

[mpgioia]

Or... even easier.. not do a PBF.. and just do a floating static (influence administrative distance) over the IPSec site-to-site... ?

[santonic]

Yes, bu what will make primary route be deleted? You can lose connectivity but interface status remains up. 

[mpgioia]

---

@santonic wrote:

Yes, bu what will make primary route be deleted? You can lose connectivity but interface status remains up. 

---

Understood.. given the fault scenario and permutations/combinations of fault.

Floating static alone might be enough.. and in other scenario's monitoring on a PBF might be needed.

I have enough to build my traffic engineering anyhow.. Thanks all.