Dear All,
please i will need your advice.
Our head office is connected to 3 other branch offices with a VPN connection provided by ISP 1. All equipment used are RB750 routers. ISP1 provides both VPN with Internet. At the same time, we have a second ISP (say ISP2) as backup Internet link in all the branches (with no VPN). This ISP2 uses Huawei modems. We have a critical application at the head office which can be accessed either by either a VPN link (primary route) or through the Internet (secondary route) on a specific port. We proposed to ISP1 to do a failover connection using the RB750s such that, if his link (which is primary) goes down, there should be an automatic failover to the backup link of ISP2. He then went ahead and connected the Huawei modems to eth5 of the RB750 . But we are not seeing the device failing over to ISP2.

I am sort of confused and i think the ISP tech is confused too. Considering that ISP1 provides both VPN and Internet, on which of these should the heartbeat signal listen to? At what point should the router switch over to the backup Internet Link - when VPN fails or when the Primary Internet Link fails? Please, can someone suggest what could be the best method of implementing this? Can the RB750 even handle such a scenario? I think the ISP tech doesn't master this.

Thank you

No one in the forum to help?

Hello, I don't know if I'll give you the best option.
To do a dynamically failover between two sites I would recommend you to set up GRE+IPSec tunnels.
Using this you will be able to let the OSPF take care of your routes.

But if you do not use OSPF, have you tried use "check-ping" option on routes?
If the route comes unavailable, mikrotik should disable automatically.

Hello, I don't know if I'll give you the best option.
To do a dynamically failover between two sites I would recommend you to set up GRE+IPSec tunnels.
Using this you will be able to let the OSPF take care of your routes.

But if you do not use OSPF, have you tried use "check-ping" option on routes?
If the route comes unavailable, mikrotik should disable automatically.

I confirm this option with check-ping works. You just need to set up two links where backup one will have higher metrics. Routing will go through primary connection as long as it is active. In case of failure traffic will be redirected to secondary connection because routing table entry will be disabled by check-ping option

Ser@fin