I would like to establish a redundant IPSec connection between pfSense and Cisco boxes using two different ISP connections. The network schema should be something like:

LAN1
    |
pfSense
|        |
ISP1  ISP2
|        |
  Cisco
      |
    LAN2

One of ISPs is unstable so I want to have automatic failover. I checked for similar configurations at Cisco site, they propose to use GRE tunnels over IPSec link and run some routing protocol (OSPF/iBGP) on top of them.

I don't think I can use OpenVPN with Cisco GRE tunnels…

Questions:

• is there a solution for this problem? ( :P)

• does pfSense support GRE tunnels? (BSD should have support for them) If yes, how it is possible to configure GRE tunnel interface at pfSense box?

• is it possible to NAT GRE flows? (I may have configuration with two pfSense boxes, one behind other, IPSec tunnel is terminated on external box but the GRE tunnel should be terminated at internal one)?

• is it possible to use Load Balancing over two IPSec tunnels?

Thanks for your consideration,

WBR,
Igor