0

We have two ISPs, each of which has assigned us a bank of public IP addresses.
Let's call the first ISP "VZON" and the second ISP "CCAST".

Telephony (VoIP) traffic goes out the VZON gateway; all other data traffic goes out the CCAST gateway.

There is a site-to-site VPN connecting a remote site via the CCAST gateway. We would like that VPN to be "more or less highly available".

Since that's a fuzzy term, I will define what we mean by it. If the CCAST gateway connectivity fails (perhaps CCASTS's router fails, or someone accidentally pulls the electric plug) we would like a "standby" VPN to come online automatically using the VZON gateway; and once the failure on the CCAST gateway has been fixed, we would like the VPN to revert automatically to use CCAST gateway.

Does this scenario require two hardware firewalls at the remote site? Or can a single firewall (let's say some CISCO SRX model) configure two VPNs, using different gateways on the other end, and treat one of them as a "standby", bringing it online only when it detects that the remote peer is "dead" (by using Dead Peer Detection or some other method).

P.S. If a single firewall with a primary and a "standby" VPN is not possible, is it possible to have two concurrent VPNs, but have one of them get 90% of the traffic and the other 10%, again using only a single firewall at the remote site, and no additional devices, but when the connectivity on the "main" VPN fails, the load shifts automatically to 100% for the "ancillary" VPN.

TRomano
  • 111
  • 7

1 Answers1

1

In short: no, you don't need two firewalls on the remote site, rather a single firewall capable of dual WAN management, and with dual VPN peer capability. Basically any modern firewall supports these features.

Obviously, this means that a firewall failure will bring down the VPN tunnel, regardless of how many internet connections do you have. To guarantee against such possibility you had to use two firewalls to create a single high-availability cluster, a feature which is generally available on businness-oriented appliances.

shodanshok
  • 47,711
  • 7
  • 111
  • 180
  • Understood about firewall failure. Does "dual VPN peer capability" allow for a primary VPN with the secondary in (automatic) standby mode? – TRomano Dec 15 '16 at 16:22
  • Yes, it means you can define a VPN with two different peer IP addresses (a primary or preferred one and a secondary or backup one) – shodanshok Dec 15 '16 at 16:40