topic Re: Peer to same remote from VX-environment. in General Topics

Peer to same remote from VX-environment.

950117ec-6722-4 — Wed, 31 Oct 2018 15:09:04 GMT

Hi ! I have problem with VPN tunnel in a VSX environment, I would like to build two VPN tunnel to the same remote peer-adress from two different VS, is that supported ?

My gateway-server is on 77.30 and the management-server on 80.10.

It look good from the beginning and booth of the tunnel rise, but after a while one of them goes down and

get "authentication failure" when the remote side tried to connect.

The remote peer that I would like to peer with is located on a Juniper, Junos firewall.

Thank you for some help.

/Yngve

Re: Peer to same remote from VX-environment.

Vladimir — Thu, 01 Nov 2018 01:18:06 GMT

Do your VS' have unique public IPs assigned to their external interfaces or are they behind common VSwitch or external router being NATed to the same public IP?

Re: Peer to same remote from VX-environment.

950117ec-6722-4 — Thu, 01 Nov 2018 07:55:48 GMT

Booth of the VS have unique ip-addresses and are connected with a common VSwitch to Internet.

Re: Peer to same remote from VX-environment.

950117ec-6722-4 — Thu, 01 Nov 2018 08:18:43 GMT

Some more information,

we use the same "Interoperable Device" object as gateway in two different VPN community type meshed and we don't use Multi domain management. Hopefully I describe the setup on this case. I have not yet tried

this setup to other vendors than Juniper, I will try to use a Cisco ASA but it looks that it should be some problem

in my CP environment.

Re: Peer to same remote from VX-environment.

Maarten_Sjouw — Thu, 01 Nov 2018 15:53:42 GMT

Are the 2 tunnels built in 1 community or in the same?

I would build 1 star community with the remote site as a center and set VPN routing to from satelite to center only.

This way you have 1 PSK for both tunnels, I have a customer running this type of setup with some different appliances to Amazon (although they are not VS's).

Re: Peer to same remote from VX-environment.

950117ec-6722-4 — Fri, 02 Nov 2018 07:23:35 GMT

We have 2 separate community, because there are different company in each VS and they should not be dependent to each other. But maybe I can build this as one community and deny traffic between the two satellite.

But does any know if my setup would bee possible, we are going to use MDM in a feature and does that change any in this case?

Re: Peer to same remote from VX-environment.

950117ec-6722-4 — Fri, 02 Nov 2018 08:58:06 GMT

But, when I build a start community I have only one of my VS that are the center gateway and if that one goes down the

traffic from the satellite to the other VS does not work.

A picture for no misunderstanding.

Re: Peer to same remote from VX-environment.

Maarten_Sjouw — Fri, 02 Nov 2018 13:31:16 GMT

This is why I said, build a Star with the REMOTE gateway as the CENTER, you can disallow traffic from one to the other VS.