Fastest VPN Failover

VPN
1

I work in rural Ohio, and we finally have been able to add backup fiber WAN circuits to several of my sites. My main site with our biggest data center has redundant fiber, Charter 500x500 and horizon 100x100. I run a couple of Windows file servers using DFS as a file repository for folder redirection for my users. As we are able to get redundant and better circuits in our remote sites, we’ve been adopting the model of moving their on-site data store over to our main data center there for saving funds in hypervisors and SANs, etc. However, this brings up the need for the best possible VPN configuration as their data will now all reside over a tunnel.

​

Currently - all of my remote sites are using the site-to-site style tunnels. A few of the sites have dynamic WAN addresses so they are set up with IKEv2 to negotiate the tunnel. During testing, I would disable the x1 interface (our main Charter Fiber) and test a full fail-over simulation. Several of the remote sites took longer than expected to connect to the secondary WAN interface (our Horizon fiber) and reestablish the tunnels.

​

We are passing VoIP, Access Control management, as well as data over the tunnel. So the delay causes a huge amount of issues.

​

All that to be asked, what direction would everyone head in? Route-based tunnels over a tunnel interface? SD WANs for sites with multiple wans?

2

Route based tunnels is how I do it. Each site has multiple tunnels (I.e. If a site and the head end each have 2 wan connections then I would have 4 tunnels… X1 to X1, and X1 to X2, X2 to X1, and X2 to X2.

I figure out which tunnel has the lowest latency and priotize the metrics accordingly.

3

Anyone have issues resolving windows dns over the route based tunnel? I enabled net bios over the tunnel … I can ping my windows dns server from the remote site but it won’t resolve and dns… yes I have the dhcp scope on the remote side pointed back the private IP of my servers at the main site…

4

if your remote wan having dynamic ip address, u need to use the mode as aggressive mode inatead of ikev2 mode

5

  1. Check Windows Firewall (or other local firewall such as those bundled with antivirus produxts) on your DNS Server. Often times the default rules don’t allow connections from other subnets.

  2. Check your remote site sonicwall LAN to VPN rules to ensure rule is there as well. Substitute LAN for appropriate zone.