Dual WAN ECMP Load Balancing - IPSEC

[Jason_Mead]

Hi Guys, Looking for some documentation on ECMP load balancing with an IPSEC vpn on one of the load balanced connections. We want to have all internet traffic going down one connection and all the VPN' s on the other connection but in the event of failure switch internet between the two. We have the service functional using Weighted ECMP however we are getting one way VPN traffic. Not sure if anyone has a document or ideas about load balancing and internet traffic? Kind Regards, Jason

[emnoc]

I don' t think you can ECMP load-balance vpn-ipsec in this way and here' s why? if you think about it, the VPN tunnels are defined as pointA to pointB. So the remote party typically has your " WAN" interface address installed in it' s configuration. So if provider for WAN1 goes down, that network interface would be unreachable. Now for the good news. I have a fix that would work, but you need to being using dynamic routing with BGP for example and install a loopback for holding up the VPN. Ensure the loopback-address is advertised two 2 or more provider. Nail the VPN as a interface rt-based vpn to the loopback. This will allow for a few items such as load-balancing and as long as the one of the ISP connection1/2 is up, you VPN will always be up. ( ipsec built with loopback interface ) config system interface edit " loop0" set vdom " root" set ip 192.0.2.28 255.255.255.255 set type loopback <---- must be type loopback here set alias " loopback-interface" set snmp-index 277 next end and config vpn ipsec phase1-interface edit " vpn1" set interface " loop0" set ike-version 2 set proposal aes256-sha256 set remote-gw 1.0.2.2 set psksecret ENC IHRvb1VRI7ExQt/17DvZkCE4CGFi9cOaHr8Mq45v8AsD8ABv3UOYzosi83JX13NlSa6cAs2PCSuRImvAz0jHdcMkCa94nBv3/l+rzEDh+9WFEH5A+kVZZIzHPIaAoHsVsMfXNTTwaHIkhwzovn/iUkePPImtdRLxjefV1iUzTdwub26KWaooK5kjpei6AlnTf0r76w== next end The rest of the vpn cfg is your fywpolicies and static route for the rt-based On the generic traffic ECMP take a look at virtual-wan-link features in 5.2. You have plenty of examples generic load-balancing and link fail-over & recovery

[ShrewLWD]

Hmm, I use ECMP and have an IPSEC tunnel between our HQ and the satellite locations. I set up up the IPSEC as Dial-up User at HQ, use the Peer-ID/Local-ID settings to uniquely identify the tunnel(s), and set up two VPNs at the satellite locations, one for WAN1, one for WAN2. Where I differ, is that my tunnel and my primary traffic is WAN1, with a failover to WAN2, but, depending on the traffic you are sending up the tunnel, and if you make the IPSEC tunnels interface mode, you could possibly set up static routes that would solve your issue. Let' s assume; WAN1=0.0.0.0/0 RemoteVPN_IP=192.168.1.0/24 InterfaceIPSEC_WAN2 InterfaceIPSEC_WAN1 You should be able to set static routes like so; 0.0.0.0/0 -> WAN1 -> (ISPGATEWAY_IP) Priority 0 Distance 10 192.168.1.0/24 ->InterfaceIPSEC_WAN2 Priority 0 Distance 10 192.168.1.0/24 ->InterfaceIPSEC_WAN1 Priority 5 Distance 10 (or) 0.0.0.0/0 -> WAN1 -> (ISPGATEWAY_IP) Priority 0 Distance 10 192.168.1.0/24 ->InterfaceIPSEC_WAN2 Priority 0 Distance 10 192.168.1.0/24 ->InterfaceIPSEC_WAN1 Priority 0 Distance 20 Throw in your necessary firewall polices, and a DGD, as needed.

[emnoc]

Yeah that' s doing ( 2 vpn-tunnels ) but not exact what I was picturing when the op said " load balancing ipsec" . Here you just have 2 ipsec-tunnels with traffic going across both via static routes. Not exactly loading balancing the ipsec protocol in it' s self.

You should be able to set static routes like so; 0.0.0.0/0 -> WAN1 -> (ISPGATEWAY_IP) Priority 0 Distance 10 192.168.1.0/24 ->InterfaceIPSEC_WAN2 Priority 0 Distance 10 192.168.1.0/24 ->InterfaceIPSEC_WAN1 Priority 5 Distance 10 (or) 0.0.0.0/0 -> WAN1 -> (ISPGATEWAY_IP) Priority 0 Distance 10 192.168.1.0/24 ->InterfaceIPSEC_WAN2 Priority 0 Distance 10 192.168.1.0/24 ->InterfaceIPSEC_WAN1 Priority 0 Distance 20

And not to draw confusion; " this is not load-balancing but provides path failure via 2 redundant tunnels." Due to the distance and or priority value, you are routing over one link at a time. Next, what are we talking to at the other end? A cisco ASA, opensource box, another fortigate or juniper? That all will determine what and if you can do dual vpn-tunnels to the same end-point imho

[ggntt]

Hi guys We are running a cluster, this will give us box failover. We want to route IPSEC traffic from the FG cluster over WAN2 to a FG cluster at the other side. (All other internet traffic over WAN1) In the event that WAN2 goes down we want the IPSEC VPN to failover to the WAN1. Likewise if WAN1 goes down we want internet traffic to fail over to WAN2 I want to keep the solution as simple as possible (Should we use a routing protocol ?) Thanks greg

[MikePruett]

setup dual tunnels, set routes to make one the primary and if the circuit goes down the other takes over.