Failover VPN

[sollostech]

Is it possible with pfSense 1.2.3 or with the 2.0 version to configure failover VPN? I don't think this is possible with IPSec on pfSense, but I was hoping it might be possible with OpenVPN. Have a client that wants to connect three locations to the primary store that handles all transaction processing and they want to have the primary connections going over a Cable connection and then failing to a DSL. Main location will be on a T1 as its primary with Cable as backup.

[GruensFroeschli]

This should be pretty easy with openVPN.

I would setup 6 OpenVPN server.
3 at the central office and one in each satellite.
Now each satellite connects to the mainoffice and the mainoffice to each satellite.
Essentially have two concurrent tunnels from each site.
With OpenVPN you have the ability to specify multiple servers and how to connect to them (balancing/failover).
OpenVPN adds routes dynamically when the tunnel come up
and removes them when the tunnel goes down.

The endproduct wold look something like that: client connects to server. Routes are added to reach the server subnet over this link.
The server connects to the client. Routes are added to reach the client subnet over this link. So one tunnel for traffic in one direction and one for in the other direction.

Now if any link fails, the openVPN failover switches to the other WAN/server.

[sollostech]

We attempted to set this up previously with 1.2.2 and had major issues where connectivity was failing until we disabled the VPN tunnels. The instructions we followed were from the OpenVPN site. Perhaps they must be modified on pfSense or we did something wrong? Single OpenVPN tunnels were fine.