VPN IPSEC REDUNDANT WAN1 WAN2

BlueTeam

How to configure two USG 60 to manage a VPN IPSEC site to site redundant wan1 wan2. The two firewalls already present a failover internet configuration with interface Trunk wan 1 wan2.

Thank you

Ian31

You can use route-based IPSec VPN tunnel interfaces to build a load balance or failover Trunk.
1. Build 4 IPSec VTI tunnel and interface, 
    USG A:wan1 - USG B:wan1 -> vti1
    USG A:wan1 - USG B:wan2 -> vti2
    USG A:wan2 - USG B:wan1 -> vti3
    USG A:wan2 - USG B:wan2 -> vti4

You can refer this KB, How can I configure IPSec site-to-site VPN by using VTI
https://kb.zyxel.com/KB/searchArticle!gwsViewDetail.action?articleOid=015634&lang=EN

2. Add VTI interface into a Trunk
    Note:
    you need to configure connectivity check in each VTI interface first. To ping the peer vti interface ip address. So that system know if the tunnel is good or not.  
    (1) go to CONFIGURATION > Interface > Trunk > User Configuration > Add Trunk
    (2) add vti1 ~ vti4 as active interface
    
3. Add policy route
    Source: USG A subnets
    Destination: USG B subnets
    Next hop: the trunk you create in step 2
    SNAT: none 
 
The same concept to configure the USG B. 

BlueTeam

Thanks for the reply.
It is possible to do this without VTI.
Thank you

Zyxel_Stanley

Hi @BlueTeam

VIT interface is required.

The traffic redundancy is controlled by “Trunk” setting.

It controls load balancing algorithm (WRR/LLF/Spilover) on your VPN tunnel interfaces.