IPSEC tunnel now active when Static route on WAN connection is larger than primary

Forum|Forum|6 years ago
July 13, 2020
7 replies
8074 views

60D on 6.0.9

I've run into this issue before for other clients and haven't figured it out.

When in a multi-WAN scenario:

Primary Private fiber connection: Wan2 (OSPF) Static Route with Distance of 10

Backup ISP: DMZ static route with a distance of 20

IPsec tunnel on DMZ port with Static route with a distance of 10

This IPsec tunnel will not stay active unless we change the Distance of the Backup ISP to 10?

But this puts our WAN2 and DMZ in a load-balancing scenario, and we want to keep active-passive setup.

How can we keep the backup ISP in a passive state and keep the VPN tunnel up?

IPsec

Toshi_Esumi

SuperUser

I'm assuming you meant "static default route" by "static route".

My first suggestion is if the IPsec peer public IP is static (not dynamic), setting /32 static route for the peer IP toward the DMZ port, so that regardless the priority/distance of the default routes to the WAN2 and the tunnel, the tunnel always comes up and stays up.

If that's not an option, the second suggestion is to set a low "priority" on the default route to DMZ (higher number of priority) to the DMZ port. It might not establish the tunnel from local end, but since it's still in the routing-table if the other side's tunnel establishment attempts would be returned to the port it came in (DMZ port).

You didn't explain how you want to utilize two default route paths; WAN2 and Tunnel when the tunnel is up. But based on your distance settings they would load-balance with ECMP logic.

SmokeyMountian_TechAuthor

New Member

I'm assuming you meant "static default route" by "static route". My first suggestion is if the IPsec peer public IP is static (not dynamic), setting /32 static route for the peer IP toward the DMZ port, so that regardless the priority/distance of the default routes to the WAN2 and the tunnel, the tunnel always comes up and stays up.

-We're using static Ip's

If that's not an option, the second suggestion is to set a low "priority" on the default route to DMZ (higher number of priority) to the DMZ port. It might not establish the tunnel from local end, but since it's still in the routing-table if the other side's tunnel establishment attempts would be returned to the port it came in (DMZ port). You didn't explain how you want to utilize two default route paths; WAN2 and Tunnel when the tunnel is up. But based on your distance settings they would load-balance with ECMP logic.

-What we're trying to do is have:

1. Primary Internet and private network access to use WAN2 always

-At the same time that WAN2 is being used we need to have the IPsec VPN tunnel always up on the DMZ internet connection.

Currently, we have 3 static routes configured for this:

1. 0.0.0.0/0 DMZ Distance = 20

2. 0.0.0.0/0 WAN2 Distance = 10

3. public IP VPN interface on the DMZ port = Distance = 20

If the WAN2 Distance is lower than the Distance on the DMZ the VPN tunnel fails to come up.

If we change the Distance on WAN2 to be the same or higher (25) then DMZ the VPN tunnels comes up right away.

How can we keep a lower distance to prioritize traffic to use WAN2 and also keep the VPN tunnel up on the DMZ port?

sw2090

SuperUser

hm

we got plenty of IPSec S2S Tunnels here. Each is connected to a specific lan while SD-WAN takes care for the internet traffic. Those all work fine. Even redundant routing with different prios and distances for subnets that have to be reached via tunnels works fine here.