Results 1 to 7 of 7

Thread: IPSec with VRRP

  1. #1
    Newbie
    Join Date
    Jan 2019
    Posts
    7

    Default IPSec with VRRP

    We are implementing a new network setup at a new data center and have the option of a high bandwidth Internet connection replacing our leased lines. I am looking into the options and Untangle is always among them.
    In order to connect the new data center to the existing sites we would need to do IPSec VPNs from a pair of VRRP'd Untangle firewalls to Cisco devices. Naturally I assume this works and works well but I had to ping here to see if my assertions are correct.

    Also on the back end these Untangle devices need to support OSPF to Cisco devices but I assume that would work fine since OSPF is a standard that neither entity has domain over, no? Thus OSPF between a Cisco and Untangle device should work.

  2. #2
    Untangler jcoffin's Avatar
    Join Date
    Aug 2008
    Location
    Sunnyvale, CA
    Posts
    7,816

    Default

    In working with Cisco equipment over the years including coding, Cisco seems to have their own favor of standards. So YMMV.
    Attention: Support and help on the Untangle Forums is provided by
    volunteers and community members like yourself.
    If you need Untangle support please call or email support@untangle.com

  3. #3
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    23,346

    Default

    Yeah, I've never done this but been curious about it a few times. Because VRRP doesn't really get involved here. You have a tunnel per device, and you use OSPF to keep the routing loops under control.

    All the moving parts are there, but if any of them is off for whatever reason... splat.

    All I can say is... Good luck! And be glad you aren't trying this with Meraki! It doesn't have IKEV2 support, now Untangle can do v1, but Meraki's v1 is stupidly picky.
    Last edited by sky-knight; 06-27-2019 at 10:09 AM.
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

  4. #4
    Newbie
    Join Date
    Jan 2019
    Posts
    7

    Default

    Ok let's back up a bit and say I was going UT to UT, both ends are VRRP clusters and they're doing IPSec tunnels between each other. How well do they stay connected and/or reconnect if say the active node drops for whatever reason?

  5. #5
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    23,346

    Default

    As I understand it, VRRP is irrelevant. You have a separate tunnel for each interface pair you want to connect.

    I would double check with support to see if you can't get away with terminating on the VRRP address instead, because that makes things much simpler.

    OpenVPN is available on the VRRP address, so when I do VRRP on OpenVPN stuff, if a router dies I just have some tunnels that need rebuilding, they usually do it all on their own. Sometimes I have to power cycle the OpenVPN app.
    Last edited by sky-knight; 06-27-2019 at 10:24 AM.
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

  6. #6
    Newbie
    Join Date
    Jan 2019
    Posts
    7

    Default

    Not OpenVPN, IPSec VPN. I want to establish site to site tunnels that come up on their own when interesting traffic presents itself.
    So I'm curious how the IPSec VPN works on the VRRP interface. If this is even worth pursuing?

  7. #7
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    23,346

    Default

    As I said, I'm not sure because I've never done it. However, the fact that OpenVPN operates off the VRRP shared IP address tells me that IPSec most likely can as well. As far as I know the only things that don't operate off the aliases in question are the http/https management services.
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

SEO by vBSEO 3.6.0 PL2