Parallel MPLS and IPSEC VPN tunnel

RouterOS General
1

I have a client with two office locations with fiber connections.
The two sites are currently connected through a MPLS conection provided by the ISP.
Both sites also have a back-up LTE connection.

The way the LTE back-up currently works is that it’s always live but it has a higher route distance than the fiber connection, so traffic is only routed over it when the fiber WAN’s gateway is unreachable.
So far this seems to work fine, though it’s possibly not a ideal setup?

Now what I would like to achieve is to also have a site-site tunnel over the LTE back-up connections on both sites for when the fiber connection goes down on either site.

I’ve created a IPSEC tunnel between the two LTE connections and this tunnel works fine. The issue is, how do I route traffic over the MPLS vpn per default and only use the IPSEC tunnel when the MPLS is not available? Now the traffic between the two sites is choosing the IPSEC tunnel per default when both are live and I can’t seem to use route distances for this, as the IPSEC tunnel does not create a entry in the ip/routes table.

2

Would you kindly post your config for review?

/export file=anynameyouwish (minus sensitive info)

3

Bare IPsec works exactly this way - it overrides the result of “normal” routing for any traffic that matches the traffic selectors of the policies. To obtain virtual interfaces that can be used as a gateway of a route, you have to set up an IPIP or GRE tunnel and use IPsec only to encrypt the transport packets of that tunnel.

1 Like
4

Thanks Sindy, that confirms what I suspected.
I’ll look into the alternative methods.