Hi Jason, In order to make your redundancy, You have to think it at different level : => At Wan level : you need the SSG5 to automatically detect that your WAN link is broken. Here is how you can make it. * Configure default WAN link with a default route preference at 10 * On default WAN interface, configure TrackIP to ping your default GW, a router on your provider's network or your provider's DNS. The goal is to check full connectivity to Internet (if the two WAN links are provide by the same provider, it is not necessary as the 2 link shall goes down the same time) * Configure backup WAN link with a default route preference at 20
=> At VPN level : a little more difficult. You have to solutions : using VPN group with policy-based VPN or using routed-based VPN and backup at routing level. I will explain routed-based VPN (I prefer). * Create a zone for you VPN traffic and activate "Asymmetric VPN" * Create 2 tunnel interfaces (tunnel.1 and tunnel.2) and put it in VPN zone * Create your 4 VPN Gateway : 2 binded on default WAN interface and 2 binded on backup WAN interface * Create your 4 Autokey ike using the 4 gateways. Bind the 2 using default WAN on tunnel.1 and the 2 using the backup WAN on tunnel.2. Active VPN monitor (+ rekey + optimized) on each (with default settings) * Create your routes to LAN behind other SSG with no next-hop and through tunnel.1 with preference 10 * Create your routes to LAN behind other SSG with no next-hop and through tunnel.2 with preference 20 * Create your policy from Trust to VPN, DMZ to VPN or anything you need... How will it work ? You will have 2 default routes but using only the one with lower preference. If trackIP failed, interface will be "administratively" be DOWN and default route inactive so the Internet traffic will used other link. You 4 VPN will be always UP. The routes with preference 10 will be used by default. If the link comes down, VPN will comes down too and route will be inactive so traffic to other LANs will used the backup VPN. "Asymetric VPN" will authorized to failover between VPNs without disabling session so traffic will failover "transparently" for users. Regards, -- Romain PILLON Network Engineer INTERDATA -----Message d'origine----- De : [email protected] [mailto:[email protected]] De la part de Jason Lixfeld Envoyé : mercredi 15 avril 2009 18:36 À : Juniper-Nsp Objet : [j-nsp] SSG5 Dual WAN failover functionality I'm pretty new to Juniper, so please forgive any blatant missteps in terminology. I've got a requirement to build three sites using SSG5s. The three sites will all have dual WAN - PPPoE DSL and DHCP cable. We will be using provider space for the dual WANs, so we won't be using our own IP space, BGP or anything of the like; only static routing to 0/0 to one of the two WANs. The three sites will be meshed with LAN to LAN IPSec tunnels. I understand I'll need to build two meshes on each device; one for each WAN circuit because they will both have two different WAN IPs. Can the SSG5 intelligently sense that a WAN link is broken and failover to the other? In the DSL and Cable worlds, rarely is an outage caused by a hard link failure, rather something in between causing traffic to stop. Can the SSG5 detect outages such as this and make a decision to fail over? Can it also make the same determination in order to fail back once the primary WAN link has been restored? If I have two IPSec meshes, can SSG's do any sort of IPSec WAN tracking so the only one mesh is up at at time? _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
