UniFi SD-WAN failover with IPsec tunnels

Networking & Firewalls
1

I’ve had great success with Site Magic and WAN failover on the UniFi UDM and UCG series equipment. Very easy to setup and only takes about 30 seconds for the secondary WAN to take over and rebuild the tunnel when the primary WAN fails.

My problem is that I’m in need of maintaining an IPsec tunnel as well as the Wireguard tunnels constructed through Site Magic. That leaves me with two questions, but feel free to chime with the proper way to handle this if I’m headed in the wrong direction.

  1. My understanding is that I will need to have two IPsec tunnels created in order cover the failover. One tunnel using each of the WAN interfaces?
  2. I’m under the impression that I will need to use OSPF to accomplish all of this, but Site Magic is already controlling the elements I need to configure. Will I need to stop using Site Magic and build everything up manually?

I looked around the internets and could only find pieces of the puzzle. If anybody has any experience with this situation I’d love to hear your thoughts.

Thanks!

2

I don’t know what the other side looks like (Azure, AWS, non-Unifi, etc….) but maybe two IPSec tunnels and then Policy Based Routing can allow you to prefer the tunnel on the primary circuit?

Could also use BGP instead of OSPF.

3

Thank you for the reply. I believe the other side is a SonicWall.