Multiple IPsec Tunnels with Same Egress IP

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

There is a need to know if there can be multiple IPsec tunnels with the same egress IP connected to different Cloud SWG data-centers.  This for the purpose of having a failover ready for the IPsec tunnel currently serving as the primary access method (Firewall/VPN).

Resolution

An IPsec tunnel to another Cloud SWG data-center can be set up as a failover with the same egress IP as another IPsec tunnel.  Whether that secondary tunnel is active or not depends on your firewall or vendor's implementation of IPsec and your own IPsec configuration.  Your actual experience may vary.

To address current outages or other issues, see the links to articles below:

• Mandatory Data to Gather After a Network Related Outage for IPSEC
• Mandatory Data to Gather During a Network Related Outage for IPSEC

Here are some other resources regarding failover and other IPSec issues tunnels:

• IPSec failover setup for Cisco ASA
• IPsec Tunnel Failures