2

I have a multihomed setup with two ISPs with similar bandwidth characteristics. I want to route my traffic to a remote site via ipsec, so that my local network traffic goes through the tunnel and comes out of the remote site endpoint (with no regard to which one of ISP was used in the process). This should be somewhat similar to link aggregation and lacp — in order to avoid reordering of tcp packets one stream is being sent via exactly one link even if more than one is available (based on some hashing).

Is the similar scheme achievable with ipsec? I mean use two ISPs to route ipsec traffic, withstand failure of single ISP and do balancing over ISPs per stream (not per packet).

Improve this question
1
  • 1
    ECMP across two (ipsec) tunnel interfaces.
    – Ricky
    Commented Jun 4, 2016 at 8:31

1 Answer 1

Reset to default
3

Yes you can do this. As @RickyBeam so loquaciously points out ;-), you can configure routers on both sides to use a routing protocol (OSPF for example) that allows Equal Cost Multi-Path. Each router will learn both paths from the other router and load balance (per stream) between them.

Your VPN tunnels must allow the routers to learn routes from each other. For OSPF, you either need to allow multicast (GRE over IPSEC), use a Virtual Tunnel Interface (Cisco), or manually configure the neighbors as a NBMA network. Which method you choose depends on the type of router.

Improve this answer
3
  • Do I understand correctly that I could do ECMP statically on linux by adding a default route with several nexthop's of equal weight? (like that: ip route add default nexthop via <...> weight 1 nexthop via <...> weight 1).
    – Alexander Sergeyev
    Commented Jun 4, 2016 at 12:06
  • I'm not a Linux expert, so I can't say for sure if it will load balance. You will also need to do the same thing on the other side.
    – Ron Trunk
    Commented Jun 4, 2016 at 13:29
  • Yes. And most routing platforms can do the same with static routes.
    – Ricky
    Commented Jun 4, 2016 at 21:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.