There are two methods to configure the IX15 device to fail over from a primary IPsec tunnel to a backup tunnel:
-
SureLink active recovery—You can use SureLink along with the IPsec tunnel's metric to configure two or more tunnels so that when the primary tunnel is determined to be inactive by SureLink, a secondary tunnel can begin serving traffic that the primary tunnel was serving.
-
Preferred tunnel—When multiple IPsec tunnels are configured, one tunnel can be configured as a backup to another tunnel by defining a preferred tunnel for the backup device.
Required configuration items
- Two or more configured IPsec tunnels: The primary tunnel, and one or more backup tunnels.
- Either:
- SureLink configured on the primary tunnel with Restart Interface enabled, and the metric for all tunnels set appropriately to determine which IPsec tunnel has priority. With this failover configuration, both tunnels are active simultaneously, and there is minimal downtime due to failover.
- Identify the preferred tunnel during configuration of the backup tunnel. In this scenario, the backup tunnel is not active until the preferred tunnel fails.
IPsec failover using SureLink
With this configuration, when two IPsec tunnels are configured with the same local and remote endpoints but different metrics, traffic addressed to the remote endpoint will be routed through the IPsec tunnel with the lower metric.
If SureLink > Restart Interface is enabled for the tunnel with the lower metric, and SureLink determines that the tunnel is not functioning properly (for example, pings to a host at the other end of the tunnel are failing), then:
-
SureLink will shut down the tunnel and renegotiate its IPsec connection.
-
While the tunnel with the lower metric is down, traffic addressed to the remote endpoint will be routed through the tunnel with the higher metric.
For example:
-
Tunnel_1:
- Metric: 10
-
Local endpoint > Interface: ETH
-
Remote endpoint > Hostname: 192.168.10.1
-
SureLink configuration:
-
Restart Interface enabled
-
Test target:
-
Test type: Ping test
-
Ping host: 192.168.10.2
-
-
-
Tunnel_2:
-
Metric: 20
- Local endpoint > Interface: ETH
-
Remote endpoint > Hostname: 192.168.10.1
-
In this configuration:
-
Tunnel_1 will normally be used for traffic destined for the 192.168.10.1 endpoint.
-
If pings to 192.168.10.2 fail, SureLink will shut down the tunnel and renegotiate its IPsec connection.
-
While Tunnel_1 is down, Tunnel_2 will be used for traffic destined for the 192.168.10.1 endpoint.
Web
- Configure the primary IPsec tunnel. See Configure an IPsec tunnel for instructions.
- During configuration of the IPsec tunnel, set the metric to a low value (for example, 10).
- Configure SureLink for the primary IPsec tunnel and enable Restart interface. See Configure SureLink active recovery for IPsec for instructions.
- During configuration of the IPsec tunnel, set the metric to a low value (for example, 10).
- Create a backup IPsec tunnel. Configure this tunnel to use the same local and remote endpoints as the primary tunnel. See Configure an IPsec tunnel for instructions.
- During configuration of the IPsec tunnel, set the metric to a value that is higher than the metric of the primary tunnel (for example, 20).
- During configuration of the IPsec tunnel, set the metric to a value that is higher than the metric of the primary tunnel (for example, 20).
Command line
- Configure the primary IPsec tunnel. See Configure an IPsec tunnel for instructions.
- During configuration of the IPsec tunnel, set the metric to a low value (for example, 10):
(config vpn ipsec tunnel IPsecFailoverPrimaryTunnel)> metric 10 (config vpn ipsec tunnel IPsecFailoverPrimaryTunnel)>
- Configure SureLink for the primary IPsec tunnel and enable Restart interface. See Configure SureLink active recovery for IPsec for instructions.
(config vpn ipsec tunnel IPsecFailoverPrimaryTunnel)> surelink restart true (config vpn ipsec tunnel IPsecFailoverPrimaryTunnel)>
- During configuration of the IPsec tunnel, set the metric to a low value (for example, 10):
- Create a backup IPsec tunnel. Configure this tunnel to use the same local and remote endpoints as the primary tunnel. See Configure an IPsec tunnel for instructions.
- During configuration of the IPsec tunnel, set the metric to a value that is higher than the metric of the primary tunnel (for example, 20):
(config vpn ipsec tunnel IPsecFailoverBackupTunnel)> metric 20 (config vpn ipsec tunnel IPsecFailoverBackupTunnel)>
- During configuration of the IPsec tunnel, set the metric to a value that is higher than the metric of the primary tunnel (for example, 20):
IPsec failover using Preferred tunnel
Web
- Configure the primary IPsec tunnel. See Configure an IPsec tunnel for instructions.
- Create a backup IPsec tunnel. See Configure an IPsec tunnel for instructions.
- During configuration of the backup IPsec tunnel, identify the primary IPsec tunnel in the Preferred tunnel parameter:
Command line
- Configure the primary IPsec tunnel. See Configure an IPsec tunnel for instructions.
- Create a backup IPsec tunnel. See Configure an IPsec tunnel for instructions.
- During configuration of the backup IPsec tunnel, identify the primary IPsec tunnel:
- Use the ? to view a list of available tunnels:
(config vpn ipsec tunnel backup_ipsec_tunnel)> ipsec_failover ? Preferred tunnel: This tunnel will not start until the preferred tunnel has failed. It will continue to operate until the preferred tunnel returns to full operation status. Format: primary_ipsec_tunnel backup_ipsec_tunnel Optional: yes Current value: (config vpn ipsec tunnel backup_ipsec_tunnel)> ipsec_failover
- Set the primary IPsec tunnel:
(config vpn ipsec tunnel backup_ipsec_tunnel)> ipsec_failover primary_ipsec_tunnel (config vpn ipsec tunnel backup_ipsec_tunnel)>
PDF
