Zyxel USG20W-VPN primary and backup link setup and IPSEC VPN

malekad · February 24

Hello guys,

I have USG20W-VPN with latest firmware installed and just need little bit help with setuping my primary and backup link WAN connection.

Firstly - I am using the DSL WAN connection that will work as primary link (WAN) and if this connection will fail automatically backup link will go active (Cellular, Brovi 4G USB Dongle).

I have setup both connections but I am struggling how to setup as primary and backup connection. I have configured the Trunk as you can see bellow (weighted round robin where wan_ppp is primary DSL connection and cellular is used as backup link connection.

Also in interface WAN I have configured the Check connection to know if the connection is active or not.

If I disconnect the DSL WAN primary connection the router do not automatically go to backup link connection. How to setup please?

Also I am struggling with setuping IPSec tunnel - specifically with connection switching (when the primary connection fails to establish a tunnel for a backup connection).

I have IPSec VPN tunel with other company site-to-site connection. Where I have first IPSec called DSL_VPN (with public address of primary connection) and second IPSec tunel called Backup_VPN that is used only when the primary connection is unavaible.

Now the question is how to setup IPSec tunel to automatically switch to connection that is available, is there any settings for metrics or primary and secondary WAN for IPSec tunnel (I saw only for the SITE2 there is option for primary and secondary)?

Because if I enable and connect Cellular (backup link connection) both tunnels is connected (but the Cellular connection is trying to connect the primary tunnel only for WAN). I need to setup the second Backup_VPN tunel to be active if the primary WAN connection failed

If any questions please let me know, I really appreciate your ideas and comments.

Zyxel_Judy · March 10

Hi @malekad ,

Regarding the WAN failover issue, please confirm the following:

You need to select "User Configured Trunk" as the Default WAN Trunk.

Under Network > Interface > Ethernet, both WAN interfaces have Connectivity check enabled with a valid IP address. Use smaller values to trigger failover more quickly.

Zyxel_Judy · March 10

Hi @malekad ,

Regarding your IPsec VPN issue, please try configuring DDNS by entering the DDNS information and setting the Primary and Backup Binding Address with your wan_ppp and cellular IP.