Skip to main content
vstrabello
Explorer
June 30, 2017
Question

Redundant, policy-based IPsec VPNs

Is there any way to make redundant IPsec VPNs by using policy-based VPNs?

 

The situation is that customer remote firewall have two links to the Internet and when the main link goes down, there is no commutation of traffic to the now active, backup link, needing to move it's respective policy before the downed policy to keep the traffic going between the locations.

 

Or just say, a route-based IPsec VPN would be enough?

 

Thanks!

 

Vitor

    2 replies

    EMES
    New Member
    June 30, 2017
    Route based all the way.
    neonbit
    New Member
    July 1, 2017

    +1 for route based.

     

    Create a VPN zone and put both IPSEC interfaces in the zone. You only have to create one set of policies for both VPNs now.

     

    DPD (dead peer detection) is enabled by default, but the default value will only failover after 60 seconds. I'd recommend putting the timers down if you want the failover to happen quicker.

    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT