Policy to balance a Speedfusion connection with a WAN

An HD2 with

  • two cellular connections bonded as a Speedfusion connection to the home office
  • one WAN connection, usually via a satellite

To be able to establish an outbound policy for a weighted balance of the WAN and the Speedfusion connection. Or suggestions for how to achieve such a result by other means.

E.g., 80%/20% of the traffic goes to the Speedfusion/WAN connections respectively.

The weighted balance Outbound Policy only allows the balancing of the physical WAN ports/connections (i.e., the two cellular and the single wired connection in the HD2 case).

There is the general observation that VPN and Speedfusion connections are not first-class citizens - they are not available for policy creations except in the priority and enforced policies.

I would suggest that weighted load balancing between cellular and satellite WANs will lead to a horrible user experience. A single user activity that uses multiple sessions to multiple end points (like skype) will be horrible due to the contrasting latency.

It would be much better to direct devices / traffic that are not latency sensitive to the satellite WAN and send the rest via cellular.
have a read of this post for some ideas.

You might also find this interesting - using asynchronous SpeedFusion to lower the apprent latency over satellite WANs.



Thanks for the two articles, they are indeed wonderfully informative and useful.

W.r.t. balancing a WAN with a multi-path Speedfusion connection: I understand the issue with user experiences mixing (long-latency) satellite with other (low-latency) connections.

However, in this particular scenario there are other policy rules that take care of the user-experience-sensitive connections - the balancing is a resource management tool for bandwidth-management of connections that are not latency-sensitive.

Additionally, the balancing need holds equally for other scenarios where the WAN and the Speedfusion connections are to be balanced or otherwise both treated as connections subject to policy, e.g. when the WAN connection varies from time to time due to equipment changes on the WAN while the basic Speedfusion connection infrastructure does not.


I have been using SpeedFusion as a WAN and not a VPN for a long time. We use it as a Virtual WAN with programmable characteristics. The request to have it in the list of weighted balance possibilities is pending in a roadmap but they get quite crowded. This is mainly due to a routing point of view. If your speedfusion tunnel leads to internal network of the company, it has nothing to do in the WAN segment, your routing table would be enough.

So what do we do? We cheat :smiley:

Assign a specific VLAN to a subnet, assign it to port LAN1.
Route all traffic from this subnet through SF.
Plug an ethernet cable cable between LAN1 and a WAN1.
Plug your satellite in WAN2
Create a weighted balance rule between WAN1 and WAN2

And voilà

By the way, using the max bandwidth per tunnel option (let’s say 4Mbps/4Mbps) , you can also have some nice traffic shaping in %age per user group as the max capacity of WAN1 is now known


That is a delightfully inventive kluge :grinning:.

Thanks, and I’ll keep it in mind for future deployments.

In this particular instance, I’d have to be looking for that second WAN port, though (the equipment at hand has only one WAN port and one LAN port).

Hd2 has 2 wan ports. Or you are referring to hd2 mini?

If it is the mini… just plug a usb to ethernet adapter in the usb port :wink:

1 Like

In this deployment we are talking about HD2 IP67s (deployed outside) and MAX Transit Duos.

Dont you have access to a usb port inside the ip67?
Been a long time since I opened one.

What is connected behind the transit?

The IP67s have not been opened after installing the SIM cards. We are loath to start messing with the internals.

What is connected behind the transit?

On the LAN side there are WLANs and wired (managed) switches.



Ok so you can use the wifi as wan to loop on your wlan with the transit. Not ideal but should work.

1 Like

Some clarification is needed here.

The solution I proposed has not been tested. In fact, turns out its creating a rout conflict/incoherency in the ARP table and no traffic goes from WAN to LAN. I’m running it under different scenario’s but keep failing on this exact point. Even adding the USB ethernet port isn’t a solution as it will be added in the list of known MAC addresses and ARP resolution fails.

:warning: Suggestions welcome, how can we solve this ( only using one device) to reach speedfusion weight balancing? :rocket: :warning:

Ok, I found out a way to make it work.

I had to go through a L2 tunnel to bypass all the ARP/IP conflicts. So unfortunately not a solution with fusionhub but working with all the other combos :smiley:

@PeplinkTeam Any delivery schedule on the Virtual Balance ? :wink:


+1 for a Virtual balance for Layer 2 routing games like this.


Directly bring everyhting straight to VM firewall via Layer2 and manage all networks simply :star_struck:

Very nice looking traffic shaping now


1 Like

+1 for a Virtual balance for Layer 2 - any plans on this?

1 Like