How To Use VPN/MPLS as a Backup(MPLS

Scenario)

How To Use VPN/MPLS as a Backup (MPLS Scenario)

Applicable Version: 10.00 onwards

Overview
Most of the companies have multiple branches and more often than not, a good network connectivity
(Wide Area Network) across these branches is a must to accelerate the speed of business. Some of
the popular options available for such geographically spread enterprises to connect with other
branches and head office are Managed Leased Lines, MPLS (Multi Protocol Label Switching) VPN
connectivity, VPN Over Internet Leased Lines, Satellite based VSAT systems and many more.
In order to safeguard against network connectivity outage, which entails business loss, organizations
must ensure that they have alternative cost effective connectivity options that provide secure access.

Network Schema
Consider a hypothetical network where a VPN Link and an MPLS Link connects a Head Office (HO)
and Branch Office (BO).
Head Office:
The Head Office Cyberoam has been configured with Port A as LAN, Port B as WAN and Port D as
DMZ. The MPLS link has been terminated on DMZ (Port D).
Cyberoam LAN IP: 192.168.1.254
Cyberoam WAN IP: 202.134.168.202
Cyberoam DMZ IP: 10.10.10.2 (MPLS Link)
Branch Office:
The Branch Office Firewall configured as follows:
LAN IP: 192.168.2.254
WAN IP: 202.134.168.206
DMZ IP: 11.11.11.1 (MPLS Link)

How To Use VPN/MPLS as a Backup (MPLS Scenario)

Scenario 1: VPN Link as a Backup for MPLS Link

Configure Cyberoam to failover to an IPSec VPN Link when the MPLS link fails. This is required to
provide uninterrupted connectivity between the HO and BO. When the MPLS link comes up again, the
status quo is restored.

Configuration
You can configure the failover to an IPSec link when the MPLS link fails by following the steps
mentioned below.

Step 1: Configure IPSec Connection between HO and BO

Refer to the article How To - Establish Site-to-Site IPSec Connection using Preshared key for details
on how to establish an IPSec VPN connection between HO and BO.

Step 2: Set IPSec Link as Backup to the MPLS Link

Login to Cyberoam CLI Console.

Go to Option 4. Cyberoam Console and execute the following command.

custom> cyberoam link_failover add primarylink PortD backuplink vpn
tunnel IPSec_Link monitor PING host 10.10.10.1
Syntax:
cyberoam link_failover add primarylink
<Port on which MPLS is connected>
backuplink vpn tunnel <VPN link name on which traffic needs to be forwarded>
monitor PING host <IP address of the remote device which needs to be monitored
for failover>
Note:

Make sure that the IPSec connection is active and connected before configuring it as a
backup link.

You can also use TCP for monitoring the remote device. The Syntax is:
cyberoam link_failover add primarylink <Port on which MPLS is connected>
backuplink <VPN link name on which traffic needs to be forwarded> monitor TCP
host <IP address of the remote device which needs to be monitored for failover>
port <port of the remote device which needs to be monitored for failover>

Step 3: Configure Static Route

Configure static routes to redirect all BO destined traffic from MPLS Link.
1. Configure Interface-based Routes which points to the remote network (192.168.2.0).
2. Configure Gateway-based Route which points to the MPLS device that is monitored by Cyberoam
(11.11.11.1). This route is necessary if you want to preserve the static routes even when the
MPLS Link fails over to VPN.

How To Use VPN/MPLS as a Backup (MPLS Scenario)

Configure Interface-based Route for Remote Network:

Login to Cyberoam Web Admin Console using Administrator profile.

Go to Network > Static Route > Unicast and click Add to add a static route using following
parameters.
Parameter Description
Parameter

Value

Description

Destination IP

192.168.2.0

Specify Destination IP Address

Netmask

/24 (255.255.255.0)

Specify Subnet Mask

Gateway

10.10.10.2

Specify Gateway IP Address

Interface

PortD 10.10.10.2

Select Interface from the list

including
Physical
Interfaces,
Virtual Sub-interfaces and Aliases.

Click OK to save the route.

Configure Gateway-based Route for Monitored MPLS Device

Login to Cyberoam Web Admin Console using Administrator profile.

Go to Network > Static Route > Unicast and click Add to add a static route using following
parameters.
Parameter Description
Parameter

Value

Description

Destination IP

11.11.11.1

Specify Destination IP Address

Netmask

/32 (255.255.255.255)

Specify Subnet Mask

Gateway

10.10.10.2

Specify Gateway IP Address

How To Use VPN/MPLS as a Backup (MPLS Scenario)

Click OK to save the route.

Step 4: Set Highest Priority for Static Routes

By default, VPN routes have the highest priority (Route Precedence) in Cyberoam. To set
highest priority for Static Routes:

Login to Cyberoam CLI Console.

Go to Option 4. Cyberoam Console and execute the following command.

cyberoam route_precedence set static vpn

The above configuration sets the VPN Link as a backup if the primary MPLS Link fails.

Scenario 2: MPLS Link as a Backup for VPN Link

Configure Cyberoam to failover to an MPLS Link when the primary VPN link fails. This is required to
provide uninterrupted connectivity between the HO and BO. When the MPLS link comes up again, the
status quo is restored.
By default, Cyberoam gives higher precedence to VPN Routes over Static Routes. In other words,
when a VPN Link is established, Cyberoam gives first preference to the VPN routes. If the VPN Link
fails, the traffic is automatically redirected via the static routes for MPLS link. Hence, Cyberoams
default behaviour favours this deployment and no additional configuration is required.
Note:
If the MPLS Link is configured on Non-WAN port, for example, between the LAN Port on HO and DMZ
Port on BO, add the following IPSec Route from Cyberoam CLI.
console>cyberoam ipsec_route add net 192.168.2.0/255.255.255.0
tunnelname IPSec_Link
Re-establish the VPN tunnel after adding the IPSec Route.

Document Version: 2.2 7 May, 2015