Hello All. Having an issue with a configuration that has dual ISP's and dual IPSEC tunnels going to a my data center firewall. I'm using IP-Monitoring to fail over to the secondary ISP interface and it fails over great.
Brief Configuration / Detailed to follow:
- DATA_CENTER / PEER: 3.3.3.3 / IKE_GW: CLIENT_P_GW [server: 1.1.1.1 2.2.2.2 ] DPD
- CLIENT_P / PRIMARY_PEER: 1.1.1.1 / IKE_GW DC_PRIMARY: server 3.3.3.3 DPD
- SECONDARY_PEER: 2.2.2.2 / IKE_GW DC_SECONDARY: server 3.3.3.3 DPD
Basically what is happening is that everything fails over the DC_SECONDARY VPN connection just fine.. Works great till the primary ISP connection comes backup.. The secondary ike and ipsec will not drop and fail over to the primary connection. I'm not sure if the DPD is actually keeping the ike alive on the secondary connection.. I have monitoring turn on the vpn. but i'm thinking that may be keeping it alive. There is no traffic able to make it do to the route changes in the ip-monitoring so I'm at a loss and tried some many monitoring configuration to get it drop. So, I need to get other eyes on the configuration to see what bonehead mistake I've made.
@@@@@@@@@@@@@@@ SITE P --- Redunant ISP Connections @@@@@@@@@@@@@@@ JUNOS: 12.1X46-D82 PRIMARY - fe-0/0/7 - IP : 1.1.1.1 SECONDARY - fe-0/0/7 - IP : 2.2.2.2 ------ IKE -------------- gateway DC_PRIMARY { ike-policy ike-mitec-standard; address 3.3.3.3; dead-peer-detection { optimized; interval 10; threshold 3; } external-interface fe-0/0/7; } gateway DC_SECONDARY { ike-policy ike-mitec-standard; address 3.3.3.3; dead-peer-detection { optimized; interval 10; threshold 3; } external-interface fe-0/0/6; } ------ IPSEC -------------- vpn DC-PRIMARY-vpn { bind-interface st0.0; vpn-monitor { optimized; } ike { gateway DC_PRIMARY; ipsec-policy standard-proposals; } establish-tunnels immediately; } vpn DC-SECONDARY-vpn { bind-interface st0.12; vpn-monitor { optimized; } ike { gateway DC_SECONDARY; ipsec-policy standard-proposals; } } rpm { probe ISP_Probe { test PrimaryISP { target address 4.2.2.1; probe-count 5; probe-interval 5; test-interval 10; thresholds { successive-loss 10; total-loss 10; } destination-interface fe-0/0/7.0; next-hop 1.1.1.1; } } } ip-monitoring { policy Track-ISP { match { rpm-probe ISP_Probe; } then { preferred-route { route 0.0.0.0/0 { next-hop 2.2.2.2; } route 10.123.222.0/24 { next-hop st0.12; } route 192.168.11.0/24 { next-hop st0.13; } route 172.21.21.0/24 { next-hop st0.12; } } interface st0.9 { disable; } interface st0.0 { disable; } } } } ###################################################################################### JUNOS: 15.1X49-D170.4 OUR_DATACENTER : 3.3.3.3 ######################################################################################
------ IKE -------------- gateway CLIENT_P_GW { ike-policy mitec-phase1; address [ 1.1.1.1 2.2.2.2 ]; dead-peer-detection { always-send; interval 10; threshold 3; } external-interface ge-0/0/0; } ------ IPSEC -------------- vpn CLIENT_P_VPN { bind-interface st0.5; vpn-monitor { optimized; } ike { gateway CLIENT_P_GW; ipsec-policy standard-proposals; } } ######################################################################################
Thanks Chris