Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We are experiencing an issue with our SonicWall NSA 2400 Firewall. We have a secondary gateway over IPSec setup in the event of a failure of our main ISP (which is unfortunately common). The secondary gateway is a 4G connection through Verizon and the cost grows as data usage increases.

The firewall switches over to the secondary gateway properly, but then sometimes will not renegotiate and switch back to the primary when it comes back up. Hitting 'Renegotiate' on both sides seems to fix the issue, but I am wondering if there is something I am missing that may be causing it to stay on the secondary.

I don't think this has anything to do with the settings as it seems to work 50% of the time, but here they are anyway in case someone has some tips on how to ensure switching back to primary when the connection is restored.

Policy Type: Site to Site

Auth Method: IKE using Preshared Secret

IKE Phase 1 proposal:

Exchange: Main Mode

DH Group: Group 1

Encrypt: AES-256

Auth: SHA1

Lifetime: 3600 (seconds)

Phase 2 proposal:

Protocol: ESP

Encrypt: AES-256

Auth: SHA1

Lifetime: 900 (seconds)

Keep Alive is enabled, and Preempt Secondary Gateway is enabled at 120 second interval.

share|improve this question

migrated from superuser.com Nov 21 '13 at 21:25

This question came from our site for computer enthusiasts and power users.

    
So they're just letting you know right in the product name that it's government backdoored these days huh? –  Arthur Kay Jul 16 at 17:11

2 Answers 2

You can have your VPN to fail back to the primary gateway by checking the "Preempt Secondary Gateway" box and specifying a desired interval for a failback attempt.

See screenshot

share|improve this answer

Three things to check:

  1. The preempt to secondary gateway option MUST be active even on the remote peer
  2. On the 4G-enabled firewall, edit your WWAN connection profile and set it to "persistent connection" or "dial on data"
  3. In the load-balancing page, edit the LB Group and check that your WWAN connection is selected as the "final backup interface"
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.