SpeedFusion with balance 210 in Dropin mode in front of firewall and shared ip

Hello,
I need to implement the following diagram

I have install a balance 210 in drop-in mode with shared public ip address, everything is working fine. The problem is that the remote Peplink Balance One Core is not able to establish a PepVPN tunnel with the balance 210.

PepVPN tunnel state stuck at starting on both side.

thanks for your assistance

Dear @rudy,

I simulated similar setup (FW 8.0.2) and can confirm that PepVPN cannot be established from a remote node with internal IP to local node with external IP on Balance working as Drop-in + shared IP.

We are checking internally if that scenario can be improved.

Now a workaround is (if my assumption is correct with your setup) - external IP on your Balance One Core. Then the tunnel can be initiated from Balance 210.

To be sure, please confirm what is your IP configuration at site B.

Thanks

1 Like

Thanks Ricardas,

The Balance One Core have already a GRE tunnel on the WAN 1 interface with another device. At this time we can’t disconnect it.

We will try to have another public Ip for the 210.

Hoping the scenario will be improved in futures releases.

Thanks

1 Like

Hey Ricardas,

I got this new public IP from my ISP 210.10.8.37/32, the old IP address is 210.10.10.2/30.

I have setup drop-in mode with the same gateway on both side but the Balance 210 (in /30, Balance 210 device don’t allow network address in /32 on drop-in interface) failed to see firewall connected as client and the firewall lost internet connection.

Also i failed to add a static route to the to my LAN trough the next hop 210.10.10.2 Error : Device not in the same subnet with the WAN interface

thanks for your assistance

This link should be helpful:

I know this can be done but would allow the Balance to work normally, and provide NAT and DHCP for Site A, just as you have at site B. I would put the firewall in transparent mode instead of having the Balance in drop-in mode.

Tunnel can not been established with this IP addresses.
Need to have IP addresses in same subnet.