Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 8 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 4292 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site to Site VPN- Best Method

Jae Lupo

I just upgraded our 4 firewalls to XG (latest build).  We use IPsec firewalls.  When a firewall is rebooted or there is a power failure the IPsec VPNs do not reconnect on their own.  I have to mess around with both sides of the tunnel to get them to connect again.  I created a new SSL VPN between two sites and it works fine after a reboot.  What is the current preferred method for Site to Site VPNs, IPSec or SSL?  If it is IPSec why wouldn't my VPNs connect on their own after a restart.  Thanks.


Jae



This thread was automatically locked due to age.
  • 0

    So all your firewalls that connect to each other are XG? If so, SSL Site2Site or RED is best case senario. I use both on various companies and it's recipe for success. A bit tricky though if you want to make mesh network rather than a star, but still. Reconnection happens as soon as the fw is online.

  • 0 in reply to Panagiotis Vakerlis

    Thank you for the info.  Yes, we have all XG firewalls.  I am more curious why IPSec VPNs do not connect on their own.  I can convert to SSL VPNs but I have been using IPSec forever with no issues on UTM9.  

  • 0

    I use Site to Site SSL and it seems to work fine for me.  I have tried to use RED to connect 2 XG's but I have never been able to get it to work, the RED tunnel is established and up but I can't get traffic to flow across it.  

    I'd be curious to know which of the 3 methods, IPSec, RED, or S22 SSL the folks here find to have the best performance?

  • 0 in reply to Bill Roland

    Red between XGs works great if you tweak it right. 

    Can't tell with numbers but both seem to work equally well.

    On one company I have a star topology with Site2Site SSLVPN on which on the central one machine does video stream and one of the others in the star does the radio stream to everyone else. 7 points. Works well if the internet lines are good. On most of them they're 100/100

    On another it's red with gateway setup (though it's a dedicated red device) which flows all network data through the central which also works well(central wilth about 70 machines, red with same, maybe more). 100/100 on both sites

    Personally on my home setup I set it with a friend and another spot, all 3 with XG and RED. Works a treat for streaming from the nas. It's mostly got to do with internet speed. On home setup the central one has 200/200mbps internet line and the stars have 18/1 & 8/1 respectively

  • 0 in reply to Bill Roland

    For RED to work between XG, you have to make an ipv4 unicast rule on each device with the other's network and the red gateway. And make a LAN->LAN fw rule to allow the traffic. Not that hard, although it should be more straightforward for a red. If you need help, I'm happy to assist.

  • 0 in reply to Bill Roland

    Yes, I would like to know too what the majority of XG users are using for their VPN encryption?  I have found that the SSL VPNs have a very high latency at 600-1200ms.  This is between Australia and the UK. With IPSec it is between 200-300ms latency.  I am not sure why there is such a drastic change in speeds between the two methods.

  • 0 in reply to Panagiotis Vakerlis

    I think my problem is that I've already got a Site to Site SSL VPN up between the two so the traffic is all traversing tun0.  Even if I shut off the SSL VPN I think the traffic is still wanting to traverse that way.  

     

    I have a RED15 device out in the field and it works flawlessly, set it and forget it.  

     

    If there was a decided performance advantage to RED over SSL VPN I'd probably dedicate more time to trying to figure it.

  • 0 in reply to Bill Roland

    It shouldn't. SSLVPN Site2Site is a VPN whereas RED is actually a LAN for the XG. Anyways it's actually kind of the same at the end of the day so if your network works properly, leave it as it is.

    As fas as latency, just tried and atm the Site2Site seems faster than the RED. I got 44-60ms ping on site2site and 80-90 on red. There are a ton of differences of course which changes the outcome on networks such as device load,network load, network speeds, internet provider etc. The internet provider I mostly use has a ping of 1-4ms.