<![CDATA[IPSEC Failover - how to implement?]]>I'm planning to implement a failover IPSEC tunnel between two sites.

Site A will have to independent static connections to the internet with to ISPs.
Site B will have one static connection to the internet.

Main problem is, if one of the two connections from site A fail, the IPSEC tunnel should switch to ISP B.

How to implement this?
Would openVPN be a better option?
site2site.png
site2site.png_thumb

]]>https://forum.netgate.com/topic/102782/ipsec-failover-how-to-implementRSS for NodeWed, 22 Jul 2026 11:05:55 GMTThu, 14 Jul 2016 08:01:19 GMT60<![CDATA[Reply to IPSEC Failover - how to implement? on Mon, 25 Jul 2016 20:48:34 GMT]]>I accomplish what you request, using WAN groups and dyndns..

I attach my configurations, hope this helps you

![Screen Shot 2016-07-25 at 5.43.41 PM.png](/public/imported_attachments/1/Screen Shot 2016-07-25 at 5.43.41 PM.png)
![Screen Shot 2016-07-25 at 5.43.41 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2016-07-25 at 5.43.41 PM.png_thumb)
![Screen Shot 2016-07-25 at 5.43.50 PM.png](/public/imported_attachments/1/Screen Shot 2016-07-25 at 5.43.50 PM.png)
![Screen Shot 2016-07-25 at 5.43.50 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2016-07-25 at 5.43.50 PM.png_thumb)
![Screen Shot 2016-07-25 at 5.46.08 PM.png](/public/imported_attachments/1/Screen Shot 2016-07-25 at 5.46.08 PM.png)
![Screen Shot 2016-07-25 at 5.46.08 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2016-07-25 at 5.46.08 PM.png_thumb)
![Screen Shot 2016-07-25 at 5.47.26 PM.png](/public/imported_attachments/1/Screen Shot 2016-07-25 at 5.47.26 PM.png)
![Screen Shot 2016-07-25 at 5.47.26 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2016-07-25 at 5.47.26 PM.png_thumb)

]]>https://forum.netgate.com/post/639752https://forum.netgate.com/post/639752Mon, 25 Jul 2016 20:48:34 GMT<![CDATA[Reply to IPSEC Failover - how to implement? on Wed, 20 Jul 2016 15:43:41 GMT]]>OpenVPN is a better option for this situation. You could use a dyndns target which would switch between the ISP's at site A.
There is no way to have two targets for the same connection like you can do in some commercial firewalls.

]]>https://forum.netgate.com/post/638734https://forum.netgate.com/post/638734Wed, 20 Jul 2016 15:43:41 GMT<![CDATA[Reply to IPSEC Failover - how to implement? on Wed, 20 Jul 2016 13:57:28 GMT]]>I believe this can only be done with the help of the ISP, but I am not 100%.

I'd be interested to know if anyone provides some other idea.

]]>https://forum.netgate.com/post/638715https://forum.netgate.com/post/638715Wed, 20 Jul 2016 13:57:28 GMT