O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

19.3. Prioritize Traffic Between IPSec Tunnels

Problem

You need to prioritize traffic between two IP Security (IPSec) virtual private network (VPN) tunnels based on IP addresses and application to provide redundancy.

Solution

Create two IPSec VPN tunnels for the destination network, and bind to a tunnel interface using Next Hop Tunnel Binding (NHTB) to create two traffic paths:

	set interface "tunnel.1" zone "Trust"
	set interface tunnel.1 ip unnumbered interface ethernet0/0
	set ike gateway "Fast_link_gw1" address 2.2.2.1 Main outgoing-
	    interface "ethernet0/1" preshare xxxxx sec-level standard
	set ike gateway "slow_link_gw2" address 4.4.4.1 Main outgoing-
	    interface "ethernet0/2" preshare xxxxx sec-level standard

	set vpn "Fast_link_gw1" gateway "Fast_link_gw1" no-replay tunnel
	idletime 0 sec-level standard
	set vpn "Fast_link_gw1" monitor rekey 
	set vpn "Fast_link_gw1" id 1 bind interface tunnel.1
	set interface tunnel.1 nhtb 2.2.2.1 vpn "Fast_link_gw1"

	set vpn "slow_link_gw2" gateway "slow_link_gw2" no-replay tunnel
	idletime 0 sec-level standard
	set vpn "slow_link_gw2" monitor rekey
	set vpn "slow_link_gw2" id 2 bind interface tunnel.1
	set interface tunnel.1 nhtb 4.4.4.1 vpn "slow_link_gw2"

Use PBR to configure extended access lists based on the high-priority traffic. Then, use the action group to send the high-priority traffic to one of the IPSec VPN tunnels.

Create the second extended access list for all traffic as a catchall from previous access lists. This will also act as a backup tunnel ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required