Tunnels based on the IPsec policy (PB - policy based)

Network architecture

 

 

• The main LILLE site hosts three WAN links, two of which are main links (LIL-WAN-1 and LIL-WAN-2), and one backup link (LIL-WAN-3),
• The secondary LYON site hosts a WAN link (LYO-WAN-1).

IPsec architecture

 

 

The LILLE and LYON sites communicate through a tunnel that is based on the IPsec policy in line with the configurations described below.

LILLE site

There are several routing options for setting up the IPsec tunnel with the LYON site:

• One default route with load balancing through a router object,
• One default route with failover balancing through a router object,
• One static route with failover through a router object.

NOTE
Policy-based routing (PBR) cannot be directly used in filter rules in such configurations.

In this example, the FW-LILLE firewall uses a router object as the default gateway with failover: when the link used is degraded, the tunnel has to be kept alive by switching to another available link.

LYON site

There are several routing options for setting up the IPsec tunnel with the LILLE site:

• A default route,
• A static route.

NOTE
Policy-based routing (PBR) cannot be directly used in filter rules in such configurations.

IPsec settings:

• The IPsec peer that has been defined on the FW-LYON firewall has to be mobile (fastest solution to set up) or configured in Responder-only mode, as the FW-LYON firewall does not know which WAN access link the LILLE site will take to set up the tunnel,
• The FW-LYON firewall configuration has to allow FW-LILLE's three public IP addresses to set up site-to-site IPsec tunnels. This requires the configuration of three pre-shared keys or three certificates for the LILLE site's WAN links.
  

This document describes how a mobile peer is used with pre-shared key authentication.