Here is one more scenario I would like to have your opinion and wanted to know if this can be achieved?


#1

Hey Guys,

I do have two locations which are primarily connected through MPLS which is not directly connected to firewall. And have site-to-site VPN configured between firewall as a backup path. In this case if my MPLS goes down I will have to make manual changes and need to move routes on firewall to point it to Peplink balance which is deployed at perimeter level for balancing two links.

My firewall does not have a public rout-able IP and it is natted on peplink. Due to this I am facing numerous issues with VPN tunnel from firewall-to-firewall and decided to move VPN tunnel on Peplink so my questions are

  1. Does VPN tunnel being supported natively without any additional licenses?
  2. Once we move VPN tunnel to Peplink can we automatically failover to VPN? Like peplink will monitor MPLS link or any of the hop in MPLS path and if that is not reachable bring up the tunnel? I am aware few manual intervention would need but I am ok with that
  3. Can we have link redundancy with Peplink for VPN? so that if one link goes down VPN would automatically shift to other link?



#2

Lets see:

  1. Yes, you can use the VPN tunnel without additional license, but you can only can make SpeedFusion-VPN with another Peplink, what model do u have?
  2. If you have a SF-VPN between the two sites and the MPLS is connected as a Wan on both ends it will automatically move from MPLS to normal Internet if you use PepVpn SpeedFusion ( Balance 20, 30 see this brochure http://www.peplink.com/technology/pepvpn/ ) without your intervention. Buth more important. If you use Speedfusion Bonding technology you dont have link redundancy, you will use MPLS AND internet vpn at the same time, so if you have two isp provider and the mpls and one of the ISP goes down the vpn wont brake and will heal itself when that ISP goes up again.

See this brochure and thake a look on the option 1: MPLS Supplement

If you have and additional question you can post it here or PM.

AG


#3

Thanks for your explanation.

However to achieve I will have to move MPLS link on to Peplink right? This option can again worth of giving thought but would need to think of consequences as well.

In the current scenario I am not talking about SF but a simple IPsec VPN between peplink and firewall at other end. Does this need additional licenses?I believe it does not and I do have balance 380 which I guess supports upto 20 tunnels.

So overall I need to achieve automatic failover to VPN when my MPLS goes down. My organization does not want to invest on other peplink at this moment but few manual intervention is OK.

In this scenario I can think of

  1. Moving MPLS to peplink [need to think from every perspective then]
  2. If I can achieve redundancy though again few manual intervention is completely OK]
  3. Is is really wise to move VPN tunnel to Peplink from firewall first of all?

#4

Hi,

Actually solution from AG is recommended. You just need to have another unit of Balance router on location B then can achieve all your requirements. This is the eaiest way to configure and maintain.

Moving MPLS to Balance router is not a good option. You can’t apply Outbound Policy rule to IPSec tunnel.


#5

Ok - In this case moving IPsec VPN tunnels to Peplink could be an good option then?

And would appreciate if someone can elaborate more on point specified by AG. i.e. if I procure peplink at other location ** and then move MPLS on peplink on WAN at my end.

  1. Do I need to purchase SF license seprately?

  2. Traffic to location B will flow only through MPLS link and not via VPN?

  3. Or VPN will always be up and VPN+MPLS will be used to connect?

  4. And in this case if MPLS fails automatically traffic will be switched over to VPN?

  5. Do I also need to configure bonding then?

My apology for throwing so many questions but would like to benefits and exact requirement that I may need to purchase to achieve complete redundancy without manual intervention.

Can I send my actual diagram or can I PM that so you guys can suggest the changes?**


#6

Forget about IPSEC VPN, SpeedFusion VPN is much better and easier to configure.

No, SF licence is included on each Balance without any anual charge or something.
There is some upgrade licence from pepvn SF to SF bonding, but just for small models like B-One or Max On the Go, Since B210, SF-Bonding is included on price. See this link

As you can see pepvpn is a one wan at the time and bonding is all wan at the same time.

Traffic will go by SF-VPN, and that tunnel will use MPLS and internet at the same time.

Yes, this is correct, the SF-VPN will use BOTH connection at the SAME time.

No, the traffic will go by VPN, and if MPLS fails, then MPLS get out of SFVPN and it will continue working in a “degradated” state, when MPLS goes up again, it will be added to the SFVPN without your intervention.

The bonding is automagically configured. You dont need to do that.

dont worry, that’s what this forum is for. You only need to buy at least a B210 ( see your Wan requirements and TP) and you’re good to go.

Feel free to PM me or post the diagram. I’m sure it will be like the diagram on this study case http://www.peplink.com/solutions/case-studies/warehouse-specialists-inc/

AG