topic Re: Multi IPsec tunnels with different ISP without redundancy, with the same encryption domain in Cloud Firewall

Multi IPsec tunnels with different ISP without redundancy, with the same encryption domain

ofirshemer — Mon, 14 Dec 2020 07:10:03 GMT

Hi all,

I want to implement Multi IPsec tunnels with different ISP without redundancy.

The meaning is that I will have IPsec from FW-Branch to FW-HQ with ISP-A and IPsec from FW-Branch to FW-Internet with ISP-B.

On the branch site, it will be the same encryption domain(192.168.200.0/24)

All the FWs running R80.30

Any suggestions?

Re: Multi IPsec tunnels with different ISP without redundancy, with the same encryption domain

ofirshemer — Mon, 14 Dec 2020 07:14:17 GMT

@BarGab

Re: Multi IPsec tunnels with different ISP without redundancy, with the same encryption domain

G_W_Albrecht — Mon, 14 Dec 2020 08:15:13 GMT

What is the question ? This does not work for you ?

Re: Multi IPsec tunnels with different ISP without redundancy, with the same encryption domain

ofirshemer — Mon, 14 Dec 2020 08:24:58 GMT

Hi Albert
When I am creating the IPsec tunnels it's using ISP-A IP (80.10.10.1) for the tunnels.
I want to separate the sources.

For IPSEC-1 I will use ISP-A IP - 80.10.10.1 (from FW-Branch to FW-Internet).

For IPSEC-2 I will use ISP-B IP -160.10.10.1 (from FW-Branch to FW-HQ).

It must be without redundancy, if ISP-A is down I cannot access FW-Internet

Thank you

Re: Multi IPsec tunnels with different ISP without redundancy, with the same encryption domain

G_W_Albrecht — Mon, 14 Dec 2020 12:31:43 GMT

Yes, ok, but what is your issue ? Does it not work for you ?

Re: Multi IPsec tunnels with different ISP without redundancy, with the same encryption domain

ofirshemer — Mon, 14 Dec 2020 13:09:28 GMT

Hey Albert,
Currently is not working,
I desire to create 2 separate IPSEC tunnels on FW-Branch.
One tunnel with the source IP address of 160.10.10.1
And second IPSEC tunnel with source IP address of 80.10.10.1
Each tunnel with an encryption domain of 192.168.200.0/24.
Currently, both tunnels are with source 160.10.10.1, and this is not what I want, because when eth1 is down I lose both of my tunnels.
And I can not create another object because I can not assign the same encryption domain to different objects.

Hope it’s clearer now.
Thank you.