VPN Redundancy

[marcoodamo]

Hi everyone,

I have a question regarding the VPN feature in Apache CloudStack. Does anyone know if it's possible to configure VPN redundancy (for example, automatic failover between two Virtual Routers or across different zones)?

The goal is to ensure high availability for client VPN connections in case of a virtual router or host failure.

If anyone has implemented something like this or knows whether CloudStack supports this natively, I’d really appreciate any insights or suggestions!

It's the 4.18 ACS version and KVM hypervisor.

Thanks in advance.

[rajujith]

@marcoodamo Can you try with the redundant router option selected on the network/VPC offerings?

https://cwiki.apache.org/confluence/display/CLOUDSTACK/Redundant+Virtual+Router+Functional+Spec

[marcoodamo]

Hi rajujith, thanks

To clarify my previous question, what we are specifically looking for is VPN failover functionality within a VPC. The goal is to have two IPsec tunnels configured between the CloudStack VPC and a remote peer—one active and one standby. If the primary tunnel goes down due to any failure (such as connectivity loss or router issues), the secondary tunnel should automatically become active, ensuring uninterrupted VPN connectivity without requiring manual intervention. This setup is essential for maintaining high availability and redundancy for our VPN connections.

Does Apache CloudStack (version 4.18, using KVM hypervisor) natively support this kind of IPsec VPN tunnel failover within a VPC? If not, is there a recommended approach or workaround to achieve this behavior, possibly through external monitoring or scripting?

[weizhouapache]

@marcoodamo
I am a bit confused. You want to setup two tunnels with same peer ?

• Tunnel 1 (VPC <-> peer-1 with IP-1)
• Tunnel 2 (VPC <-> peer-1 with IP-2, or peer-2 with IP-2 ?)

[marcoodamo]

Hi weizhouapache,

Each tunnel is associated with a different internet link. When the primary link is operating normally, all traffic flows through it via the primary VPN tunnel. If that link fails, the system should automatically perform a failover to the secondary VPN tunnel, which uses the second internet link.

Tunnel 1 (VPC <-> peer-1 with IP-1)
Tunnel 2 (VPC <-> peer-1 with IP-2)

[weizhouapache]

cloudstack just setup and start the VPN connections
I think you can manage the redundancy at your side

[DaanHoogland]

@marcoodamo please let us know how you fare. it could be an interesting show and tell