Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to achieve IPSec L2L failover (ie, from one WAN interface to another) between two pfSense devices using Gateway Groups, or really anything other than defining multiple IPSec connections on both ends and disabling/enabling them manually as needed?

share|improve this question
up vote 4 down vote accepted

2.1 can do a gateway group on IPsec. Earlier versions require manual intervention for tunnel mode IPsec. Transport mode + a tunnel + a routing protocol, or more easily OpenVPN+a routing protocol, can accommodate that in all 2.x versions.

share|improve this answer
Also, can you elaborate a little bit on the OpenVPN + a routing protocol route? I would expect you use the "any" interface, but then how does the routing protocol factor in? – tacos_tacos_tacos Mar 14 '13 at 6:04
OpenVPN doesn't do failover; IPSec appears to have some bugs related to failover but should fail over if you don't trip the bugs (or so I'm reading). – Mei Jul 19 '14 at 18:48
OpenVPN can and will fail over. IPsec as well, not aware of any significant issues there, though there are occasional circumstances where you need the Sys>Advanced option to restart IPsec on WAN failure for it to successfully come up on the other WAN. – Chris Buechler Jul 24 '14 at 22:09

protected by Michael Hampton Aug 19 '13 at 15:01

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.