VPN IPSEC REDUNDANT WAN1 WAN2

Options
BlueTeam
BlueTeam Posts: 9
First Anniversary First Comment
edited April 2021 in Security
How to configure two USG 60 to manage a VPN IPSEC site to site redundant wan1 wan2. The two firewalls already present a failover internet configuration with interface Trunk wan 1 wan2.
Thank you

All Replies

  • Ian31
    Ian31 Posts: 167  Master Member
    First Anniversary 10 Comments Friend Collector First Answer
    Options
    You can use route-based IPSec VPN tunnel interfaces to build a load balance or failover Trunk.
    1. Build 4 IPSec VTI tunnel and interface, 
        USG A:wan1 - USG B:wan1 -> vti1
        USG A:wan1 - USG B:wan2 -> vti2
        USG A:wan2 - USG B:wan1 -> vti3
        USG A:wan2 - USG B:wan2 -> vti4

    You can refer this KB, How can I configure IPSec site-to-site VPN by using VTI
    https://kb.zyxel.com/KB/searchArticle!gwsViewDetail.action?articleOid=015634&lang=EN

    2. Add VTI interface into a Trunk
        Note:
        you need to configure connectivity check in each VTI interface first. To ping the peer vti interface ip address. So that system know if the tunnel is good or not.  
        (1) go to CONFIGURATION > Interface > Trunk > User Configuration > Add Trunk
      
      (2) add vti1 ~ vti4 as active interface
        
    3. Add policy route
        Source: USG A subnets
        Destination: USG B subnets
        Next hop: the trunk you create in step 2
        SNAT: none 
     
    The same concept to configure the USG B. 

  • BlueTeam
    BlueTeam Posts: 9
    First Anniversary First Comment
    Options
    Thanks for the reply.
    It is possible to do this without VTI.
    Thank you

  • Zyxel_Stanley
    Zyxel_Stanley Posts: 1,366  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    Hi @BlueTeam

    VIT interface is required.

    The traffic redundancy is controlled by “Trunk” setting.

    It controls load balancing algorithm (WRR/LLF/Spilover) on your VPN tunnel interfaces.

Security Highlight