Dual IPSec
-
Hello,
Currently I am using dual IPSec VPNs to have redundant connections between 2 data centers. Only issue I am finding is in each of them i must put a static route to allow the connection to pass on each interface of the ipsec. I have explored Gateway Groups but those do not show up when you do a static map. Is there anyway to have the dual IPSec on different subnets aka Ipsec a on 172.31.254.x and ipsec b on 127.31.253.x but yet make it so if lets say ipsec a has issues or high ping times it automatically adjust the ipsec mappings to use route b? Before you guys do ask these do take 2 different paths. My main goal is if 1 ipsec is having high ping times or such over the tunnel that it would automatically shift traffic to the other one without anyone jumping in to adjust. I do know things like BGP could probably accomplish this but in past dealings with pfsense and BGP you ended up needing 4 firewalls instead of 2. 2 for the routing of the BGP and 2 to distribute on the network. Any suggestions would be greatly appreciated. Thank you.
- tazz
-
@dcreations you can use FRR package, OSPF and BFD.
BFD with default settings, will try a hello packet every 50ms, and if it looses 3 packets, will switch the traffic to the backup path.
You can also set one side to administratively down, and by doing that, you don't need to change the cost at the other side to shift the traffic.