Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our organization uses Sonicwall devices as our gateway/firewall for all of our locations, with VPN tunnels between each of them. Each site also has a primary and backup internet line (WAN1 and WAN2), with the secondary typically being slower than the primary.

When configuring VPN tunnels, you can specify a primary and secondary "IPSec gateway name/address". Typically, we set the primary VPN gateway to be the other location's public WAN1 IP. However, what would happen in this situation...?

Site 1 WAN1:, WAN2:
Site 2 WAN1:, WAN2:

Site 1 primary VPN pointing to, secondary pointing to
Site 2 primary VPN pointing to, secondary pointing to

(notice the second site has its connections reversed)

What determines how the connection is made? Does it depend on which device receives the "VPN handshake" packet first, or will there be two parallel tunnels made, with the tunnel used depending on what side the traffic originates from? Ideally, both primary links should be connected to each other, so I'm curious as to how it works to make sure no problems occur.

share|improve this question
Are you the administrator or a user of the vpn? – t1nt1n Jan 19 '12 at 19:46
I am the administrator. – Bigbio2002 Jan 19 '12 at 20:43
I don't think it will work at all. The VPN tunnels have to be pointed at each other on both sides, you can't have it pointing to different places. – Snowburnt Apr 10 '13 at 19:18
It was working fine, I was curious as to why it is configured that way. If what you say is true, then that would explain my confusion. – Bigbio2002 Apr 10 '13 at 22:31
up vote 0 down vote accepted

I haven't been able to find anything definitive from the Sonicwall documentation about this particular situation, but I think what you may have in place are Route Based VPNs.

Also after more than one tunnel interface is configured, you can add multiple overlapping static routes; each static route uses a different tunnel interface to route the traffic. This provides routing redundancy for the traffic to reach the destination.

I think the tunnels are probably configured in this way more as an exercise than for any particular reasoning. Possibly to not have a faster and slower tunnel, but two more balanced ones?

So in the end, the primary or secondary is determined by the routes, not the tunnels. On pages 15-18, you can find a similar situation to yours.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.