General: How do I route to my central private LAN from a failed-over branch Opengear? (failover VPN)

This feature is supported by Opengear management appliance firmware 3.10.1 and later.  Also required is an Opengear model with a secondary network connection (cellular or Ethernet) for failover.

A common distributed network configuration is to have subnetted remote private LANs (e.g. branch office sites) connected back to a central private LAN (e.g. corporate headquarters) over the WAN.  This is typically achieved by either site-to-site VPNs between branch routers and headquarters VPN concentrator, or with a private circuit from your primary network provider.

This topology allows Opengear management appliances at each branch site to transparently route back to the HQ LAN for in-band access to network services such as email server to send alerts, AAA server to authenticate user access, NMS for SNMP monitoring, and Lighthouse 4 for Call Home connections.

When the primary branch WAN connection is down, e.g. during initial provisioning or network outage, the Opengear can be configured to fail over to a separate out-of-band WAN connection, e.g. cellular.  For robustness, this connection is typically separate from your primary WAN, so routes to the central HQ LAN are not automatically available.

This article details how to configure the Opengear to maintain connectivity to your central LAN during failover, by using Smart Connection Manager with Auto-Response to dynamically start and stop built-in VPN to your head-end VPN concentrator.

For this example, we’re using a private branch subnet of 10.12.34.0/24 and a central subnet of 10.0.0.0/16.  The failover connection is cellular.

Branch Opengear       10.1.1.2

Branch LAN            10.1.1.0/24

HQ Gateway            123.45.67.89

HQ VPN Server         10.0.0.254

HQ Email Server       10.0.0.253

HQ LAN                10.0.0.0/16

1. Configure VPN server

The head-end of the VPN tunnel can be any IPsec or OpenVPN based server, e.g. Cisco ASA/IOS, Checkpoint or Fortinet appliances.  This appliance may or may be the HQ gateway, or a separate system. 

It’s also possible to use Opengear Lighthouse 4 as the head-end VPN concentrator, which we will demonstrate for this example.

Detailed VPN instructions in beyond the scope of this article, but here is a reference configuration:

On Lighthouse 4, click Configure -> IPsec VPN -> Add.

Tunnel Name	headquarters_to_branch
Initiate Tunnel	<leave unchecked>
Authentication Method	Shared Secret (PSK)
Shared Secret	<choose a secret passphrase>
Authentication Protocol	ESP
Aggressive Mode	<leave unchecked>
IKE Proposal (Phase 1)	Negotiable
Perfect Forward Secrecy	<check>
Left ID	@headquarters
Right ID	<leave blank>
Left Address	<leave blank>
Right Address	<leave blank>
Left Subnet	10.0.0.0/16 i.e. the network address of the HQ LAN
Right Subnet	10.1.1.1.2/32 i.e. the internal address of the branch Opengear

Click New Option three times:

Option Name	dpddelay
Argument	30
Option Name	dpdtimeout
Argument	90
Option Name	dpdaction
Argument	clear

Click Apply. 

Note If your VPN server is behind another gateway such as a firewall, please ensure the appropriate ports and protocols are allowed and/or forwarded form the gateway’s external interface to the VPN server (i.e. UDP port 4500 if you are using Lighthouse 4 or your server supports NAT traversal, or UDP port 500 and protocol 50).

2. Configure VPN client

On the branch Opengear, click Serial & Network -> IPsec VPN:

Note All IPsec VPN tunnels will now be controlled en masse by Auto-Response, i.e. this configuration currently supports a single IPsec VPN tunnel only.  OpenVPN supports per-tunnel Auto-Response control.

Control By Auto-Response

<check>

Click Apply, then click Add. 

Tunnel Name	branch_to_headquarters
Initiate Tunnel	<check>
Authentication Method	Shared Secret (PSK)
Shared Secret	<re-enter the secret passphrase>
Authentication Protocol	ESP
Aggressive Mode	<leave unchecked>
IKE Proposal (Phase 1)	Negotiable
Perfect Forward Secrecy	<check>
Left ID	@branch
Right ID	@headquarters
Left Address	<leave blank>
Right Address	123.45.67.89 i.e. the external or forwarded address of the VPN server
Left Subnet	10.1.1.1.2/32 i.e. the internal address of the branch Opengear
Right Subnet	10.0.0.0/16 i.e. the network address of the HQ LAN

Click New Option four times:

Option Name	dpddelay
Argument	30
Option Name	dpdtimeout
Argument	90
Option Name	dpdaction
Argument	restart
Option Name	leftsourceip
Argument	10.1.1.1.2 i.e. the internal address of the branch Opengear

Click Apply.

3. Configure the failover interface

For this example, we are using a cellular-enabled Opengear at the branch office.

On the branch Opengear, click System -> Dial -> Internal Cellular Modem -> Enable Dial-Out.

Control via Auto-Response

<leave unchecked>

Complete the remaining fields as per your carrier’s details.

Note If you are using internal DNS to specify internal servers (e.g.an email servers for alerts), you may also choose to Override Returned DNS Servers and use the DNS servers on your HQ LAN.

Click Apply.

2. Configure branch primary interface for failover

On the branch Opengear, click System -> IP -> Network Interface, scroll down the Failover:

Failover Interface	Internal Cellular Modem
Dormant Failover Interface	<check>
Primary Probe Address	10.0.0.254 i.e. any internal address on the HQ LAN

Click Apply.

4. Start VPN on failover

On the branch Opengear, click Alerts & Logging -> Auto-Response -> New Auto-Response.

Name	Start VPN Failover
Reset Timeout	0
Repeat Trigger Actions	<leave unchecked>
Repeat Trigger Action Delay	0
Disable at Specific Times	<leave unchecked>

Under Check Conditions, select Network Interface Event. 

Interface	Network Interface
Events	Down

 Under Trigger Actions, select Perform Interface Action.

Action Name	Start VPN
Action Delay Time	0
Interface	IPsec VPN Service
Action	Start Interface

Click Save New Action, Save Auto-Response, then Return to Auto-Response List. 

5. Stop VPN on fail-forward

On the branch Opengear, click Alerts & Logging -> Auto-Response -> New Auto-Response. 

Name	Stop VPN Failover
Reset Timeout	0
Repeat Trigger Actions	<leave unchecked>
Repeat Trigger Action Delay	0
Disable at Specific Times	<leave unchecked>

Under Check Conditions, select Network Interface Event.

Interface	Network Interface
Events	Up

Under Trigger Actions, select Perform Interface Action.

Action Name	Stop VPN
Action Delay Time	0
Interface	IPsec VPN Service
Action	Stop Interface

Click Save New Action, Save Auto-Response, then Return to Auto-Response List. 

6. Test

Force a failover on the branch Opengear e.g. by setting the System -> IP -> Network Interface -> Probe Address to an unreachable address, or disconnecting the branch LAN and connecting directly via a laptop.

Monitor failover status under Status -> Statistics -> Failover & Out-of-Band.

Once failed over, test you can reach the corporate HQ over the VPN by clicking Manage -> Terminal, logging in to the Opengear CLI and running the command below to ping e.g. an email server or other system on the HQ LAN:

ping -I ipsec0 10.0.0.253