When policy route is used for failover IP-Sec tunnels die. Why?
Hi,
I am a lucky guy! I have two fiber hookups to the internet. One is 500M/bit, te second 100M/bit. I would like to use the 500 as the main pipe and the 100 as a failover.
Therefor I have created two policy routes where if the 500 (Ge3) fials, the 100 (Ge2) takes over. In theory this works fine as I also changed the trunk to spill-over (user configured). When I activate the policy routes my IP-Sec VPN tunnels die however.
I have been looking if I can find a way to leave the tunnels up and running but cannot find a way.
What can be the problem?
All Replies
-
Hi @JeroenSoree
Regarding to the topology you deployed, it’s our suggestion that you can implement VTI to achieve the purpose.
VTI VPN Tunnel Interface is used to configure IPSec-based VPNs between site-to-site devices.
VTI is similar to other physical interfaces so that policy route, static route and trunk can be applied when the tunnel is activated.
Here is the FAQ of how to setup IPSec site-to-site VPN by using VTI on the USG .
1
Zyxel Employee
Categories
- All Categories
- 397 Beta Program
- 2.1K Nebula
- 116 Nebula Ideas
- 78 Nebula Status and Incidents
- 5.1K Security
- 52 USG FLEX H Series
- 247 Security Ideas
- 1.3K Switch
- 70 Switch Ideas
- 907 WirelessLAN
- 34 WLAN Ideas
- 5.9K Consumer Product
- 211 Service & License
- 332 News and Release
- 71 Security Advisories
- 21 Education Center
- 5 [Campaign] Zyxel Network Detective
- 1.9K FAQ
- 880 Nebula FAQ
- 415 Security FAQ
- 221 Switch FAQ
- 195 WirelessLAN FAQ
- 46 Consumer Product FAQ
- 137 Service & License FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 73 About Community
- 63 Security Highlight
