How to dual IPSec using SD-WAN?
I'm trying to connect two sites by two IPSec tunnels. Site A has 2 WANs and site B has single WAN.
My example is exactly the same as in this technical tip:
Technical Tip: Configure IPsec VPN with SD-WAN
Document says:
Configure the Peer end Device, if it is not already done (the normal Route Priority has been used at the peer side for failover, it is also possible to configure SD-WAN on this side using the above example).
However, it does not work as expected if similarly create SD-WAN on another side because it creates circular dependency! Whatever side selects best tunnel, it selects an active route for it. As result, another tunnel becomes unavailable for SLA on another side because SLA packets cannot return, and another SD-WAN disable this tunnel as well so first SD-WAN cannot measure SLA on this tunnel anymore. At this point, initially not selected tunnel quickly becomes blocked for ever.
The obvious way how to solve this problem is to have SD-WAN only on one side, and have two static routes without SD-WAN on another side (as also suggested by document above).
But how to achieve two-way SD-WAN load balancing? Can I mix static route for each tunnel and static route for SD-WAN so packets would be always able to return?
Like this:
Side A:
Route through IPSec1 - distance 10
Route through IPSec2 - distance 10
Route through SD-WAN (IPSec1 + IPSec2) - distance 5
Side B:
Just normal SD-WAN + route as per document.
Or maybe another way is appropriate?