Secondary MX Concentrator for MR Teleworker VPN
Overview
SSIDs configured in tunneled mode (VPN tunnel data to concentrator) allow you to specify both a primary and a secondary MX for failover. If you enable a secondary concentrator, there are a few additional parameters to configure for tunnel monitoring to ensure tunnel status can be detected and have failover occur.
The additional options to configure include:
- Tunnel Health Check IP
- Tunnel Heartbeat Interval (seconds)
- Tunnel Idle Timeout (seconds)
Tunnel Monitoring
MR Teleworker VPN uses both passive monitoring and active DHCP probes to determine whether traffic can traverse each Layer 2 VPN tunnel.
Passive monitoring
The MR tracks traffic received through each concentrator tunnel. Recent inbound traffic confirms that the tunnel data path is working, so the MR does not need to send an active DHCP probe.
If no traffic is received through a tunnel for the configured Tunnel Idle Timeout, the MR begins active monitoring of that tunnel.
Active DHCP monitoring
An active health check is a broadcast DHCPREQUEST sent through a specific concentrator tunnel.
The Tunnel Health Check IP is placed in DHCP Option 50 as the requested address in the DHCPREQUEST packet. The MR does not ping, ARP for, or send a unicast packet to this address.
The tunnel passes the health check when the MR receives a matching DHCP response through that tunnel. Either of the following is considered successful:
- DHCPACK
- DHCPNAK
The response proves that the DHCP broadcast traversed the tunnel, reached the concentrator-side network, and that a response returned to the MR.
A DHCP reservation alone does not guarantee a response. DHCP-server behavior depends on its implementation, configuration, client identifier, requested address and receiving subnet. Confirm that the server returns an ACK or NAK for the actual MR-generated request.
Primary and secondary monitoring
The MR does not continuously send DHCP probes through every concentrator.
| Current state | Active DHCP monitoring |
|---|---|
| Primary is preferred and healthy | The primary is probed when its data path becomes idle. The secondary is not normally DHCP-probed while the preferred primary remains healthy. |
| MR is using the secondary | The secondary is monitored as the active path, while the primary continues to be monitored for recovery. |
| No preferred tunnel is healthy | The MR may probe all viable concentrator tunnels. |
Consequently, the secondary concentrator-side network must also return an ACK or NAK when the secondary becomes eligible for active monitoring. A secondary tunnel that establishes successfully but cannot return DHCP responses may subsequently be marked unhealthy.
Tunnel Heartbeat Interval
The heartbeat interval is how often the MR will retry the DHCP probe in case it does not get a response for a given probe. As an example, if this is set to 10 seconds, if the MR does not get a DHCP response for a give probe, it will retry that probe every 10 seconds. It will stop trying and fail over to the secondary tunnel once the idle timeout value below has been reached.
Tunnel Idle Timeout
The tunnel idle timeout specifies the max amount of time the MR will attempt to retry probes before marking the tunnel as down and failing over to the secondary tunnel. As an example, if this is set to 30 seconds and the tunnel heartbeat interval is set to 10 seconds, if the MR does not receive a response to a given probe, it will keep retrying those probes every 10 seconds until the 30 second timeout is reached. If the MR receives a response to any probe during that 30 second period, the timer will be reset to 0 and will only start incrementing towards 30 again if no response is seen. If 30s is reached, then the MR will mark the tunnel as down and fail over to the secondary tunnel.
Tunnel Failback
If an MR fails over to the secondary tunnel, it will continue to actively monitor the primary tunnel. Once the connection to the primary MX reestablishes, it will redirect client traffic back to the primary concentrator.