Is it possible to achieve IPSec L2L failover (ie, from one WAN interface to another) between two pfSense devices using Gateway Groups, or really anything other than defining multiple IPSec connections on both ends and disabling/enabling them manually as needed?
asked Mar 14, 2013 at 5:20
Add a comment
|
1 Answer
2.1 can do a gateway group on IPsec. Earlier versions require manual intervention for tunnel mode IPsec. Transport mode + a tunnel + a routing protocol, or more easily OpenVPN+a routing protocol, can accommodate that in all 2.x versions.
-
Also, can you elaborate a little bit on the OpenVPN + a routing protocol route? I would expect you use the "any" interface, but then how does the routing protocol factor in? Mar 14, 2013 at 6:04
-
OpenVPN doesn't do failover; IPSec appears to have some bugs related to failover but should fail over if you don't trip the bugs (or so I'm reading).– MeiJul 19, 2014 at 18:48
-
OpenVPN can and will fail over. IPsec as well, not aware of any significant issues there, though there are occasional circumstances where you need the Sys>Advanced option to restart IPsec on WAN failure for it to successfully come up on the other WAN. Jul 24, 2014 at 22:09