Question about Startlink IPSec

darrylwalsh

Hello,

Does anyone did an IpSec VPN over starlink ?

We've got 2 USG Flex 200, ISP fiber Router Between them, and a Starlink router in bypass mode as backup connection.

IPSec is OK by fiber.

For Startlink, the VPN is up but no traffic.

I known the problem about CGNAT and public IP, but i not network engineer...

Is there a solution ?

tonygibbs16

Hello @darrylwalsh

Welcome to the forum.

I looked at the user guide downloadable from https://www.zyxel.com/uk/en-gb/products/next-gen-firewall/usg-flex-firewall-usg-flex-200 and I think that you need to set-up a static route with a worse metric than your ISP fiber routers in order to use Starlink when your ISP link goes down.

See screenshots below from the user manual.

Screenshot_20241228-230121.png

With an allowed value for Metric between 0 and 127.

Screenshot_20241228-230548.png

Cisco call that a floating static route (according to CCNP ENCOR), but it seems like Zyxel just call it a static route with the ability to set the metric of the static route.

Happy new year and kind regards Tony