Multi WAN to Multi WAN VPN failover
-
Current setup:
Site 1 Fiber 1 (S2S OpenVPN Server 1) < ------- > (S2S OpenVPN Client 1) Site 2 Fiber 1
Site 1 Fiber 2 (S2S OpenVPN Server2) < -------- >(S2S OpenVPN Client 2) Site 2 Fiber 2
2 VPN instances at site 1, each connect to a VPN instance at site 2.
I have LAN rules on each side that use a failover group with each OpenVPN instance's gateway.
If both sides Fiber 1 go down, no problem. If both sides Fiber 2 go down, no problem.
However if Fiber 1 at Site 1 and Fiber 2 at Site 2 go down, we're down until something is reconfigured.To complicate things, we now have a 3rd WAN (Cradlepoint LTE) at Site 1. Of course the powers that be don't understand how any of this is configured, so they just bought another internet service and expect it all to just work.
We actually recently lost (for about a week) both fibers at site 1 (Hurricane Ida). Cleanup crews cut lines in multiple places.
So what do I do with WAN3? How can any of this be configured? To complicate matters you can't use the standard 1500 MTU on LTE, the VPN has to be configured with a lower MTU because LTE sucks.
Any ideas?
-
@dlogan said in Multi WAN to Multi WAN VPN failover:
If both sides Fiber 1 go down, no problem. If both sides Fiber 2 go down, no problem.
However if Fiber 1 at Site 1 and Fiber 2 at Site 2 go down, we're down until something is reconfigured.Since each client can only go out on a certain WAN, this is given by the setup.
You can allow both clients to use both WAN connections to avoid this.To complicate things, we now have a 3rd WAN (Cradlepoint LTE) at Site 1. Of course the powers that be don't understand how any of this is configured, so they just bought another internet service and expect it all to just work.
So what do I do with WAN3? How can any of this be configured? To complicate matters you can't use the standard 1500 MTU on LTE, the VPN has to be configured with a lower MTU because LTE sucks.
You can setup an additional server and client and add the gateway to the gateway group as well if you want get out max performance of each VPN.
Or simply forward WAN3 OpenVPN packets to one of the existing servers and add a remote line for it to one of the clients accepting the lower MTU. -
I think I get what you're saying. I'll play around with it. Thanks.