topic Re: ISP redundancy and VPNs to azure in General Topics

ISP redundancy and VPNs to azure

D_TK — Thu, 11 Sep 2025 21:03:41 GMT

Hi everyone,

I have a cluster where we just added a 2nd ISP link and I've configured the normal ISP redundancy and VPN link selection configs like i have on my other dual circuit locations. The one outlier at this location is that it also has a s2s with azure (vendor) and i would like to have this 2nd circuit be a backup for that tunnel as well.

Clearly it won't be as easy and seamless as the checkpoint to checkpoint tunnels are, but what do i need to do to enable this? As an aside, i don't control the azure side, and will have to involve the vendor.

R81.20 cluster, r82 management.

Thanks much,

Danny

Re: ISP redundancy and VPNs to azure

the_rock — Thu, 11 Sep 2025 21:33:58 GMT

Hey Danny,

See, tricky part with ISP redundancy is that if there is isp link failure, other side would NOT know about the new IP, so tunnel definitely would not have been established. Now, one way to "manipulate" this is to create additional static route, but that would only really help for regular traffic, not VPN.

My colleague and I did bunch of stuff for redundant tunnels with harmony sase, let me see if I can find all the notes I took about it.

Andy

Re: ISP redundancy and VPNs to azure

the_rock — Thu, 18 Sep 2025 23:54:43 GMT

Hey mate,

Please let us know if you end up getting this to work, it would help a lot of folks.

Best,

Andy