what I'm trying to achieve is a site to site IPSEC tunnel going through a load balancer, (both sites have pfsense and balancer is f5 big ip) the reason why i'm trying to do that is because: - Site A is static and will not change, needs to make connection to a static site as well - f5 balancer acts as an intermediate, receives the connection request from site A and redirects it to site B - site B is not a static site, the node attached to f5 representing site B will be changing constantly.

i did try to set it up without success by trying several combinations of site to site configs, the problem is site B doesn't have a clue how to go back to site A to establish this connection.

please let me know your opinion on how achieve this (if achievable) and otherwise what alternative good practice i could use ? many thanks


That won't work. Whipping the IPsec termination around breaks the protocol. Also, there'd be only one tunnel at any given time.

You need to create one IPsec tunnel for each WAN connection and then load balance through those, e.g. by using equal-cost multi-path routing (ECMP).

IPsec also doesn't like changing IP addresses. The implementation has to specifically support dynamic endpoints, e.g. using dynamic DNS.

  • i see, thanks for the answer. then what do you think about this scenario based on your suggestion: connect site a to f5 by ipsec, connect site b and site c to f5 by ipsec. then use multipath routing to distribute traffic from site a to site b and c through f5
    – Ahmad313
    Nov 9 '19 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.