IPSEC - VTI mode Failover with PBR

[eeebbune]

Hello Professionals,

I’m currently working on a specific concept for an image, but I'm having a bit of trouble as the results are different from what I expected. I’d appreciate it if you could let me know if there’s something I’m missing, or if my goal is simply not feasible.

Here is the drawing what I want to implement:

The setup involves two sites, Site A and Site B. Site B has dual WAN interfaces connected to two different ISPs.

My goal is to establish Route-based VPN tunnels (VTI mode) between Site A and Site B. Specifically, I want Site A to maintain an active tunnel with Site B's WAN 1 as the primary path. In the event of a tunnel failure, I need the traffic to automatically failover to the second tunnel (Site B's WAN 2).

I configured two gateways as a gateway group.

and create an allow rule like this. (Site-B)

The opposite site (Site-A) also has a same ACL rule.

I expected, if I shutdown the Tier1 tunnel, Site-B's AP will try to connect WLC over the Tier2 tunnel and site-A will also send response to Site-B over same tunnel.
However, in reality, even though AP starts connection over Tier 2 tunnel, Site-A's firewall send response to WAN interface by default route.

Which configuration makes Site-A's firewall to sends packet to default gateway rather sending Tier 2 tunnel?

I could set the static route on Site-A firewall, but we can't choose gateway group. it only allows to set interface only.

I appreciate your time.

[jimp]

The quick answer is you'll need to set the IPsec Filter Mode to VTI to allow those interfaces to use reply-to so the response traffic will use the correct interface. Set it on both sides.

That will break any tunnel mode IPsec tunnels you may have, but if you don't have any, then it's only a positive change.

The more complicated answer is that you should really run a dynamic routing protocol like BGP between those routers using the FRR package so the routing changes in a more reliable and predictable manner and isn't relying on filter trickery to avoid asymmetric routing.