SFOS V18 RBVPN Load Balancing

Question

Hi all, 
 the following article says that " XG Firewall v18 also supports RBVPN tunnel interfaces for SD-WAN policy-based routes to support IPsec and MPLS co-existence with SD-WAN. This makes it possible to enable IPsec and MPLS (even on a non-WAN zone) to both be active at the same time, with options for load balancing on VPN tunnels as well. " 
 https://news.sophos.com/en-us/2020/08/27/making-the-most-of-xg-firewall-v18-part-6/ 
 But I could not add route based VPN gateway to Wan Link Load Balancing goup. Could you please tell how can I make load balancing between two IPSEC tunnel as mentioned in article?

FormerMember · Accepted Answer

Hi Yemliha, Thanks for reaching out to Sophos Community.

You would need to configure a custom gateway and then use it as the secondary gateway or to Load balance the traffic between the gateways.

Follow this doc for more info on adding custom gateways: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/tasks/RoutingGatewayObjectAdd.html

However, XG will load-balance amongst all the available gateways. You can't bifurcate gateways from the load-balance option. If you have 1 ISP, 1 MPLS link, and 1 VPN (Custom) gateway, Then it'll be load-balancing between all three gateways which could lead to a bit of disruption as XG will also try to load-balance the remote location's traffic through your internet gateway.

FormerMember · Answer

Just adding to what DeveshM said, 
 XG firewall load balance the traffic between Active gateways. 
 If you only have a single WAN connection and don't want any disruption, then you can change its type to 'Backup' under Network > WAN link manager. If you do so then you need one SD-WAN policy route with the below parameters at bottom. 
 Source networks: Local_LAN network or Any Destination networks: Any Services: Any Application object: Any User or groups: Any 
 Primary gateway: Internet link(WAN link) Backup gateway: None 
 ==> Create SD-WAN policy route for VPN network on top of above SD-WAN policy. 
 Note: This applies only in case if you have a single WAN connection or 2 WAN connections using one as primary and other as backup. 
 For 2 WAN connections, you need to select both Primary & Backup gateway in SD-WAN policy route.

SFOS V18 RBVPN Load Balancing

Top Replies