backup vpn on backup modem interface

[Arnold]

Hi,

we are trying to config two sites with main ISP and a backup modem 3g (set as Redundant) with redundant VPN 

and I have no Idea how to do that, I found some article's but they are for live connections

https://www.youtube.com/watch?v=01KEgxqC4WI

http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%25205.0%2520Help/redundant-tunne...

right now we have a policy based hub and spoke topology with a 3g redundant modem, to connect when there is wan1 ping loss 

[emnoc]

That should be easy & trivial with 3g-usb modem and setting the distance or priority lower than the main path. Just config the modems and set this  redundant or always connected but ensure the priority is lower for the celluar path.

You will need dead-gateway  or link detect to ensure routes are lower upon the main path failure.

http://socpuppet.blogspot...d-with-huawei-and.html

[Arnold]

Hi,

making a backup on 3g was easy, making the VPN is the hard part

[emnoc]

Once again trival and easy if it's route-based.

1: You create 2 vpns, one over the main path src'ing that vpn with that interface, and  one vpn sourced using the wan-modem interface.

2: Set the routes for the dstsubnet to be lower priority for path you want to use

3: enable DPD over the vpns

4: enable the vpn monitor

5: make sure correct fwpolicies exist for traffic carried in the vpn

is that clear? and what your trying todo?

[Arnold]

that VPN in site 1 wuld work if the main isp is down and vice versa

[emnoc]

Okay you need three vpns (  the drawing helps a lot on your topology )

I never did that ( 3 vpns ) since I used mpls to backup against a private cloud ( MPLS ) using a 3g cellaur in a private APN, but I guess you could set priority over the routes on vpn#1 ( main )  vpn#2 ( 3g to main ) or vpn#3 ( 3g to 3g ) to achieve the forwarding path that you want to achieve.

Running a dynamic routing protocol might be better, but  you could easily abuse and use up your bandwidth limits on  the  3g celluar usage with the misc ospf  and other  leaked  traffic if you have low monthly allowance this could lead to a high bill.

( e.g we had one site that had a 378.00 bill since we went over our monthly allowance.....ouch )

Back on point, if you need all 3 vpns what I would do;

run ospf across  vpn#1 

set static routes on vpn#2 and #3 with the distance  weight below that of the OSPF administrative cost

than set vpn monitoring for the vpn  interface on vpn#3  ( set monitor vpn#2 ) . I'm not sure if you can run 2 monitored vpns in one monitor

This will allow for quick conversion, eliminate any dynamic routing on  the backups and allow monitoring between the backups. Just run  DPD on all devices and you should be golden ;)

Remember to set a floating static route that less preferred than the  main interface or main vpn path.

 edit: you might be able to set a backup vpn statement on vpn#2 ( against  vpn#1 ) and vpn#3 ( against #1 ). That would bring up both  vpns if the main vpn goes down. You just have to play around with it.

[Arnold]

thanks a lot, I will try to doing that