Multi-Uplink IPsec VPN

Multi-Uplink IPsec VPN

Overview

Multi Uplink IPsec VPN tunnels maximize your network's bandwidth and reliability by establishing simultaneous connections across all available uplinks to the same remote peer. Instead of using a primary and backup tunnel over a single uplink that may underutilize your available bandwidth, this feature creates multiple parallel IPsec VPN tunnels that work together to deliver enhanced performance and redundancy.

Feature

When Active Active IPsec is enabled, the system automatically establishes IPsec tunnels on every available uplink to your designated remote peer. Traffic is then intelligently load-balanced across all healthy tunnels, providing both performance gains and built-in redundancy. If any tunnel becomes unavailable, traffic seamlessly redistributes across the remaining active connections.

This feature is mainly for organizations seeking to maximize the bandwidth of multiple internet connections for Secure Internet use case to SSE PoPs.

Key Benefits

• Increased Bandwidth: Aggregate bandwidth across multiple uplinks to achieve higher throughput.
   
• Enhanced Reliability: Traffic automatically distributes across healthy tunnels, ensuring continued connectivity even if individual uplinks experience issues.
   
• Optimized SASE/SSE Connectivity: Particularly valuable for organizations connecting to Secure Access Service Edge (SASE) or Security Service Edge (SSE) points of presence, where optimal bandwidth utilization is critical for user experience.
   
• Intelligent Load Balancing: Traffic is automatically distributed across all active tunnels based on available bandwidth, optimizing resource utilization without manual intervention.

Enabling Multi-Uplink IPsec

To enable Multi Uplink IPsec:

• Create or edit an IPsec peer
• Enable Mutli-Uplink IPsec by toggling on Multi-Uplink IPsec VPN option on the peer side drawer as shown below.

Once Multi-Uplink IPsec is enabled, the same IPsec peer is established on other available WAN links. In the image above, an additional tunnel is formed on WAN2, with load balancing enabled by default over the active tunnels.

Load balancing behavior

Load balancing is only active when two or more tunnels are formed and healthy to the same remote peer. If only one tunnel is active to a remote peer, load balancing is disabled automatically.

Traffic is load balanced based on Source IP/Port and Destination IP/Port of the traffic routed. 

Failover behavior

Failover behavior remains the same as defined for Native Primary & Secondary IPsec feature. 

For Multi-Uplink IPsec failover, existing flows remain on their current tunnels, while new flows ride any newly formed tunnels. If only one active tunnel is available, all traffic will flow through the only active tunnel.

Tunnel Monitoring & Visibility

For Tunnel monitoring and visibility, see IPsec VPN Monitoring & Visibility