Community discussions

MikroTik App
 
dalami
Member Candidate
Member Candidate
Topic Author
Posts: 156
Joined: Mon Dec 12, 2011 9:18 am

Secondary routes

Tue Jul 14, 2020 9:38 pm

Having just fixed most of my self-inflicted wounds...I think I've almost figured out how much I don't know. So...

I've now established both an IKEv2 and a SSTP connection between a remote MT router and my office MT router. They work...so far. But having two VPN's my hope is to able to poke at one without compromising overall connectivity. My IPSEC setup has a split-include mode-config on the office router listing all the networks I need to able to interchange with the remote site. As a result, I *think* the necessary NAT rules and routes are auto-generated. At least - the rules are dynamically generated even if I'm not sure what's doing it...

But...the routes for my SSTP connection on the remote are manually configured and static. Which means I've defined the SSTP address/interface as the gateway for those routes. How can I have the IPSEC rules at least have higher priority than the SSTP so I'll have immediate failover as long as one connection remains up, but the "better" IPSEC routes will be primary?
 
vasilaos
Member Candidate
Member Candidate
Posts: 120
Joined: Tue Aug 04, 2009 9:50 am

Re: Secondary routes

Thu Jul 16, 2020 2:33 am

In the case of IKE2 tunnels no routes are generated and no nat rules are necessary. Instead traffic directed to the remote network follows the default route or 0.0.0.0/0 with the default gateway. Ipsec policy tells to ecrypt the data and send it over the tunnel. When you configure a static route to the destination network in this case over the sstp interface you are preventing the traffic to go over the default route because the route with smaller subnet mask has precedence. In this case you can configure another route to the destination network over the default route with smaller distance in order to give it a precedence and disable this route by a script in case the IKE2 tunnel is down so the second route with gateway the sstp interface with greater distance can kick in.
 
User avatar
vecernik87
Forum Veteran
Forum Veteran
Posts: 891
Joined: Fri Nov 10, 2017 8:19 am

Re: Secondary routes

Thu Jul 16, 2020 10:36 am

or you can just run GRE/EoIP within ipsec to make it nice routable tunnel... Is it naughty? yes. Does it cause more overhead? Yes. Does it make the whole management and failover easier to understand? Yes.
You choose what is the priority :)

ps: I am even more naugthy. I actually run EoIP with Mesh (HWMP+) through several VPNs at the same time. Not good for high performance. But reliability? oh my! You lose barely few packets when one link fails. and since it is L2, no issues with stateful firewall!
 
pe1chl
Forum Guru
Forum Guru
Posts: 10529
Joined: Mon Jun 08, 2015 12:09 pm

Re: Secondary routes

Thu Jul 16, 2020 10:59 am

For this kind of situation (although I have not tried it with IKEv2) I just use BGP to do the routing.
Peers are setup for each tunnel, and the 2 routers each announce their local subnets. Routes are created automatically, and they switch when one of the tunnels is down.
I use this to switch e.g. between GRE/IPsec and GRE6/IPsec (and sometimes L2TP/IPsec over a 4G connection) between the same sites.
To have quick switchover, I use BFD on the GRE tunnels.

Who is online

Users browsing this forum: AshuGite, Hemhems, tdw and 41 guests