Skip to main content
danielrgrein
danielrgrein
New Member
November 27, 2020
Question

Layer 2 VXLAN via VPN tunnels -Multiple VPN Tunnels How to Prioritize

  • November 27, 2020
  • 1 reply
  • 5275 views

Question, I set up a VXLAN over IPSEC with a soft switch to extend a network to a remote site.  It works, however, I have multiple ISPs and want to have a backup path for the VXLAN over IPSEC.  I was able to get it work by adding the additional "ports" to the software switch.

 

Is it possible to control which one is the "primary" tunnel for the VXLAN extended network?  One has lower latency then the other and right now it is hit and miss which one it uses.

 

Thank you in advance for any assistance.

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    November 27, 2020

    I haven't done it myself. But based on the concept the VXLAN works and the fact that FGT doesn't do STP/RSTP, I don't think you can control which L2 path to take when redundancy exists between two switches on the FGT side. It would be decided by the switches('bridges') and you might or might not be able to control in case the hops are the same. But I believe at least FGTs pass BPDUs over VXLAN (I tested only over physical link though) by default without additional config.

     

    However, I can think of a way to get the same outcome at L3 level with a FGT pair on both ends with link-monitor.

    First you set a lower number of priority or distance on the primary static route over the primary VPN, then set opposite on the backup route. Then you need to configure a set of tunnel interface IPs on both ends at least on the primary VPN (it's probably not in the VXLAN over IPsec config doc), you should be able to ping the IP on the opposite end to detect the primary IPsec down with a link-monitor. In the link-monitor, you can remove the static route on the primary side to use the backup VPN when the tunnel goes down.

     

    If you decide to adopt this idea, please let me know if it worked or not. I don't see any reason not to work though.

    andyhilton27
    andyhilton27
    New Member
    November 27, 2020

    Is it possible to connect to 2 different vpns at the same time? Need to access 2 different programs through 2 different vpns at the same time 

    mcdvoice mybkexperience

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    November 27, 2020

    First, my suggestion never disconnect VPNs. Just control the routes. Both VPNs are up all the time.

    Besides, if applications use two VPNs independently, that's NOT VXLAN. Or outside of VXLAN. If a VXLAN shares one subnet, say 192.168.1.0/24, between two locations, while 172.x.y.z/16s exists at both locations for the applications, those applications wouldn't be affected by VXLAN. They are two different/independent things each other.

    Terms & ConditionsAccessibility statement