Configure VPN Modem Failover

If your Firebox configuration includes a modem interface, you can configure the branch office VPN to fail over to the modem interface if all external interfaces cannot connect. The branch office VPN failover to a modem can be useful in a situation where you have a central office that accepts branch office VPN connections from one or more remote offices that use a modem for failover.

Before You Begin

Before you can configure modem failover for a branch office VPN, you must first configure a modem interface. For more information, see Configure a Modem Interface. After you configure a modem interface, you can select the Use modem for failover check box when you add or edit a branch office VPN gateway.

Screen shot of the Gateway Endpoints list, with the Use modem for failover check box circled
The Use modem for failover check box is visible in Policy Manager only after you configure a modem interface.

Screen shot of the Gateway Endpoints list, with the Use modem for failover check box circled
In Fireware Web UI, you cannot select the Use Modem for failover check box unless you have configured a modem interface.

In Fireware v12.0.2 and lower, before you can configure modem failover for a branch office VPN, you must first configure modem failover in the network settings. For more information, see Configure Modem Failover in Fireware v12.0.2 and lower in the WatchGuard Knowledge Base.

Branch Office VPN Configuration Requirements

To use a modem for VPN failover, the branch office VPN gateway configuration must meet these requirements:

The VPN gateway configuration must include a gateway endpoint pair for each enabled physical external interface.
The external interface for the local gateway endpoint cannot be a modem interface.
The local gateway for each gateway endpoint pair must use an ID (rather than an IP address) as the ID for tunnel authentication.
If the device has more than one external interface, the local gateway for each local external interface must use a unique ID for tunnel authentication.
The remote gateway must be reachable. Either of these configurations meet this requirement:
The remote gateway has a static IP address, and the remote gateway ID is the static IP address
The remote gateway has a dynamic IP address, and the remote gateway ID is a domain name that resolves to the dynamic IP address.

Because the device with modem failover enabled uses an ID for tunnel authentication, this device must initiate the VPN connection. This means that you cannot enable modem failover for both devices configured as gateway endpoints for the same branch office VPN tunnel.

Configure a Branch Office VPN Gateway for Modem Failover

To configure a branch office VPN gateway for modem failover, from Fireware Web UI:

Select VPN > Branch Office VPN.
To add a gateway, click Add adjacent to the Gateways list.
The Gateway settings page appears.
In the Gateway Name text box, type a name for this VPN gateway.
Select the Phase 1 Settings tab.
From the Mode drop-down list, select either Aggressive or Main Fallback to Aggressive.
Select the General Settings tab.
Configure the VPN credential method.
For more information, see Configure Manual BOVPN Gateways.
In the Gateway Endpoints section, click Add.
The Gateway Endpoints Settings dialog box appears.

Screen shot of the Gateway Endpoing Settings dialog box, Local Gateway tab

From the External Interface drop-down list, select the external interface to use for this gateway.
Select an external interface that is not a modem. If you select a modem interface, you cannot select the Use modem for failover check box on the General Settings tab.
Select By Domain Name.
In the adjacent text box, type an ID to use for the interface for tunnel gateway authentication.
The ID does not need to match an actual domain name.
Select the Remote Gateway tab.
Select Static IP Address.
In the adjacent text box, type the IP address of the remote gateway.
Select By IP Address to specify an IP address for tunnel authentication.
In the adjacent text box, type the IP address of the remote gateway.

Screen shot of the Gateway Endpoint Settings dialog box, Remote Gatway tab

Click OK.
The gateway endpoints pair appears in the Gateway Endpoints list.

If the device has more than one physical external interface, repeat these steps to add a gateway endpoint pair for each external interface. Make sure to use a unique local ID for each external interface.
Below the Gateway Endpoints list, select the Use modem for failover check box.
You cannot select this check box if the local external interface for the gateway is a modem interface.
Click OK.

The steps in the previous procedure assume that the remote gateway uses a static IP address. If the remote gateway uses a dynamic IP address, use these steps to configure the remote gateway endpoint for each gateway endpoint pair:

In the Remote Gateway settings, select Dynamic IP address.
Select By Domain Name.
In the adjacent text box, type a resolvable domain name.
Select the Attempt to resolve check box.

To configure a branch office VPN gateway for modem failover, from Policy Manager:

Select VPN > Branch Office Gateways.
To add a gateway, click Add
The New Gateway dialog box appears.
In the Gateway Name text box, type a name for this VPN gateway.
Select the Phase 1 Settings tab.
From the Mode drop-down list, select either Aggressive or Main Fallback to Aggressive.
Select the General Settings tab.
Configure the VPN credential method.
For more information, see Configure Manual BOVPN Gateways.
In the Gateway Endpoints section, click Add.
The Gateway Endpoints Settings dialog box appears.
In the Local Gateway section, select By Domain Information. Click Configure.
The Configure Domain for Gateway ID dialog box appears.

Screen shot of the Configure Domain for Gateway ID dialog box

Select Domain Name.
In the Domain Name text box, type an ID to use for this interface for tunnel gateway authentication.
The ID does not need to match an actual domain name.
Click OK.
The Domain Name information is set.

Screen shot of the New Gateway Endpoints Settings dialog box with domain information configured

From the External Interface drop-down list, select the external interface to use for this gateway.
Select an external interface that is not a modem. If you select a modem interface, you cannot select the Use modem for failover check box on the General Settings tab.
In the Remote Gateway settings, select Static IP address.
In the adjacent text box, type the IP address of the remote gateway.
Select By IP Address to specify an IP address for tunnel authentication.
In the adjacent text box, type the IP address of the remote gateway.
Click OK.
The gateway endpoints pair appears in the Gateway Endpoints list.

Screen shot of the New Gateway dialog box

If the Firebox has more than one physical external interface, repeat these steps to add a gateway endpoint pair for each external interface. Make sure to use a unique local ID for each external interface.
Below the Gateway Endpoints list, select the Use modem for failover check box.
You cannot select this check box if the local external interface for the gateway is a modem interface.
Click OK.

In the Remote Gateway settings, select Dynamic IP address.
Select By Domain Information.
In the adjacent text box, type a resolvable domain name.
Select the Attempt to resolve check box.

For more information about these gateway endpoint settings, see Define Gateway Endpoints for a BOVPN Gateway.

For more information about Phase 1 settings, see Configure IPSec VPN Phase 1 Settings.

Configure a BOVPN Virtual Interface for Modem Failover

You cannot use a modem for failover from a BOVPN virtual interface if any local gateway endpoint uses an interface that is not an external interface.

To configure a BOVPN Virtual interface for modem failover in Fireware Web UI or Policy Manager:

Select VPN > BOVPN Virtual Interfaces.
Click Add.
The New BOVPN Virtual Interface dialog box appears.
In the Interface Name text box, type a name for this BOVPN virtual interface.
Select the Phase 1 Settings tab.
From the Mode drop-down list, select Aggressive, or Main fallback to Aggressive.
Select the General Settings tab.
Configure the VPN credential method.
For more information, see Configure a BOVPN Virtual Interface.
In the Gateway Endpoints section, click Add.
The Gateway Endpoints Settings dialog box appears.
Configure the BOVPN virtual interface name and credential method.
For more information, see Configure a BOVPN Virtual Interface.
Configure the gateway endpoints as described in the previous section.

Configure the Gateway on the Remote Device

Configure the device at the other end of the tunnel to use the same authentication and Phase 1 settings. Make sure the domain name matches the name you configured on the first device. Do not select the Attempt to resolve domain check box, since this ID is not a resolvable domain name.

Screen shot of the Configure Domain for Gateway ID dialog box
Remote gateway configured to use a domain name in Policy Manager.

Screen shot of the Gateway Endpoint Setting tab, Remote Gateway, with a domain name configured
Remote gateway configured to use a domain name in Fireware Web UI.

Configure Tunnels

After you have configured your gateway, you configure tunnels between the gateway endpoints just as you would for any other branch office VPN. For more information, see Configure Manual BOVPN Tunnels.

About Modem Failover

If you select the Use modem for failover check box, a Firebox does not use the modem for the branch office VPN unless it cannot send traffic through any external interface. If all external interfaces are down, the device starts a modem connection between the two sites. It then initiates a VPN connection over the modem connection. The device uses the first local gateway ID configured for the external interface as the local gateway ID for the modem connection. Because the branch office VPN connection over a modem uses the same authentication ID as a connection from an external interface, there is no need to change the configuration of the remote gateway to enable a connection through the modem.