we're using site to site VPN as the backup solution interoffice connection and using MPLS as the primary site to site connection. The routing decision is determined by our core switch. If the MPLS is functioning, the core switch will forward the traffic to the Router that's connected to the MPLS cloud and forward traffic to other offices. When the MPLS is down, the cores switch will loses those dynamic routes from its routing table. As a result, it uses its default route to forward traffic to the Sophos UTM. Sophos sees the traffic as site to site and forward the traffic via VPN tunnel to remote offices. When we were using Cisco ASA, the fail-over is completely automatic and we would not lose the connection to the Cisco ASA while MPLS is functioning and the VPN is up. Now that we are using the Sophos to terminate the VPN, we configured the VPN and keep the VPN enable, we lose connection to the Sophos from remote office, let's say, when I try to access the Sophos UTM in site B from site A, I will not able to. But I can only access the UTM from site B only.
the reason we lose the connection is because the traffic is not return the respond traffic the same way it gets the UTM. Instead, the traffic is going in a circle.
host A in site A > site A core switch > MPLS cloud > site B coreswitch > UTM > VPN > site A UTM > core switch > host A
- I have created a more specific route hoping this specific route will take over the route that the site to site VPN tunnel builts. This does not work
- I have tested with "Bind tunnel to local interface" option but that does work.
Any help would be appreciated!
Thanks.
This thread was automatically locked due to age.
