topic Re: MEP failover speed in SASE and Remote Access

MEP failover speed

abihsot__ — Wed, 28 Oct 2020 18:17:28 GMT

Hello,

I was looking into using MEP for remote access, however I am struggling to have it running properly. Maybe you will have some ideas and will share your experience.

Two gateways (R80.40 latest) covering same encryption domain. Manual MEP mode, with load-sharing. Endpoint VPN client 82.50 for mac, 83.20 for windows.

It all works fine until I want to simulate a failure of one gateway. When connected to gateway abc, I disable it, and VPN client is stuck at reconnecting state and nothing happens. From tcpdump I see it sends udp/4500 and tcp/443 to gateway abc, but never tries the other one. I stop reconnection and try establishing new connection and with some delay connection succeeds. Tried sk115996 - no help.

Uploading trac file from the gateway just in case.

Re: MEP failover speed

PhoneBoy — Sat, 31 Oct 2020 00:31:50 GMT

If you notice in sk115996, it says the default failover timer is 2 minutes.
Even with the configuration specified in sk115996, the minimum failover time you can configure is 1 minute.

Re: MEP failover speed

abihsot__ — Mon, 02 Nov 2020 07:21:24 GMT

Yes, I am aware of that. I waited at least 10 minutes and nothing happened, hence the post. I was checking with tcpdump on the client and during reconnect not a single connection was sent to the other node. Something is wrong with the config and I can't figure it out. Anyway, TAC case registered too.