How to Configure IPsec Failover on Omada Router in Standalone mode
TL-ER7206 , TL-R605 , ER7206 , ER8411 , ER707-M2 , ER706W-4G , ER7406 , ER605 , ER706W , ER7212PC
Recent updates may have expanded access to feature(s) discussed in this FAQ. Visit your product's support page, select the correct hardware version for your device and check either the Datasheet or the firmware section for the latest improvements added to your product.
Please update Omada router to the firmware which is adapted to Controller 5.8 and above.
User’s Application Scenario
IPsec Failover provides redundancy for IPsec VPN connections. If the ISP1 Internet link goes down, a failover ISP2 Internet link takes over.
Note: The USB Port can’t be used for VPN Connection, so it can’t be used for IPsec Failover either.
All traffic between networks 192.168.0.1/24 and 192.168.10.1/24 is encrypted over IPsec site-to-site VPN tunnels.
VPN tunnel through ISP1 is the Primary tunnel, if the link over ISP1 goes down, then the Secondary VPN tunnel through ISP2 will be established automatically and pass the traffic.
Once the ISP1 link recovers, the traffic will fall back to the Primary VPN tunnel.
Configuration
Step1: Configure IPsec VPN on Router1
Note: Router1 can be any router that supports IPsec VPN, here we use Omada Router as an example.
1. Go to VPN > IPsec > IPsec Policy > IPsec Policy List, click Add and enter the parameters following:
- Policy Name: test
- Mode: LAN-to-LAN
- Remote Gateway: 0.0.0.0
- WAN: WAN
- Local Subnet: 192.168.0.1/24
- Remote Subnet: 192.168.10.1/24
- Pre-shared Key: tplink
- Status: Enable
2. Click Advanced Settings, select the Negotiation Mode as Responder Mode, and keep the other parameters of Phase-1 and Phase-2 as default.
Note: You can also specify the parameters of Phase-1 and Phase-2 as you like, just make sure the Negotiation Mode of Router1 is Responder Mode, and other parameters are the same as Router2.
Step2: Configure IPsec VPN on Router2
1. Before configuring IPsec VPN on Router2, you should make sure there are two WAN ports enabled on Router2, and both WAN Ports are linked up with ISP.
2. Go to VPN > IPsec > IPsec Policy > IPsec Policy List, click Add to create the IPsec VPN Tunnel 1, and enter the parameters following:
- Policy Name: test_1
- Mode: LAN-to-LAN
- Remote Gateway: 192.168.1.114
- WAN: WAN
- Local Subnet: 192.168.10.1/24
- Remote Subnet: 192.168.0.1/24
- Pre-shared Key: tplink
- Status: Enable
3. Click Advanced Settings, select the Negotiation Mode as Initiator Mode, and specify the other parameters of Phase-1 and Phase-2 the same as Router1.
4. Click Add to create the IPsec VPN Tunnel 2, and enter the parameters following:
- Policy Name: test_2
- Mode: LAN-to-LAN
- Remote Gateway: 192.168.1.114
- WAN: WAN/LAN1
- Local Subnet: 192.168.10.1/24
- Remote Subnet: 192.168.0.1/24
- Pre-shared Key: tplink
- Status: Enable
5. Click Advanced Settings, and specify the parameters of Phase-1 and Phase-2 the same as Tunnel 1.
6. Go to VPN > IPsec > IPsec SA, you can see Tunnel 1 is established successfully.
Step3: Configure IPsec Failover on Router2
1. Go to VPN > IPsec > IPsec Policy > Failover Group, click Add to create a failover group, and specify the parameters following:
- Group Name: test_failover
- Primary IPsec: test_1
- Secondary IPsec: test_2
- Automatic Failback: Enable
- Gateway failover time-out: 10
- Status: Enable
Note: Automatic Failback is used for automatically switching back to the primary connection when it is reachable, if you want to realize this function, you should make sure the WAN port in the remote site is Pingable.
Sometimes the remote site router blocks Ping from WAN by default, in this case, it is needed to eliminate this setting.
Take Router1 and an example:
Go to Firewall > Attack Defense > Packet Anomaly Defense, uncheck the Block Ping from WAN, and click Save to save the change.
Verification Process
1. Unplug the cable from the Router2 WAN port to simulate the Internet link of ISP1 dropouts. Go to System Tools > System Log to see the process of switching from Primary Tunnel to Secondary Tunnel.
2. Go to VPN > IPsec > IPsec SA to see if the current tunnel is Secondary Tunnel.
3. Re-plug the cable to the WAN port of Router2 to simulate the reconnection of ISP1. Go to System Log to see the switching back from Secondary Tunnel to Primary Tunnel.
4. Go to VPN > IPsec > IPsec SA to see if the current tunnel is Primary Tunnel.
Get to know more details of each function and configuration please go to Download Center to download the manual of your product.
Related FAQs
- How to configure IPSec LAN to LAN VPN for multiple subnets using the new GUI
- How to configure GreenBow IPsec VPN Client with a TP-Link VPN Router using the new GUI
- How to configure LAN-to-LAN IPsec VPN on TP-Link Router using the new GUI
- How to Set up Site-to-Site Manual IPsec VPN Tunnels on Omada Gateway in Controller Mode
Is this faq useful?
Your feedback helps improve this site.
What’s your concern with this article?
- Dissatisfied with product
- Too Complicated
- Confusing Title
- Does not apply to me
- Too Vague
- Other
We'd love to get your feedback, please let us know how we can improve this content.
Thank you
We appreciate your feedback.
Click here to contact TP-Link technical support.
TP-Link Community
Still need help? Search for answers, ask questions, and get help from TP-Link experts and other users around the world.
This website uses cookies to improve website navigation, analyze online activities and have the best possible user experience on our website. You can object to the use of cookies at any time. You can find more information in our privacy policy . Don’t show again
This website uses cookies to improve website navigation, analyze online activities and have the best possible user experience on our website. You can object to the use of cookies at any time. You can find more information in our privacy policy . Don’t show again
Basic Cookies
These cookies are necessary for the website to function and cannot be deactivated in your systems.
TP-Link
SESSION, JSESSIONID, accepted_local_switcher, tp_privacy_base, tp_privacy_marketing, tp_smb-select-product_scence, tp_smb-select-product_scenceSimple, tp_smb-select-product_userChoice, tp_smb-select-product_userChoiceSimple, tp_smb-select-product_userInfo, tp_smb-select-product_userInfoSimple, tp_top-banner, tp_popup-bottom, tp_popup-center, tp_popup-right-middle, tp_popup-right-bottom, tp_productCategoryType
Youtube
id, VISITOR_INFO1_LIVE, LOGIN_INFO, SIDCC, SAPISID, APISID, SSID, SID, YSC, __Secure-1PSID, __Secure-1PAPISID, __Secure-1PSIDCC, __Secure-3PSID, __Secure-3PAPISID, __Secure-3PSIDCC, 1P_JAR, AEC, NID, OTZ
Zendesk
OptanonConsent, __cf_bm, __cfruid, _cfuvid, _help_center_session, _pendo___sg__.<container-id>, _pendo_meta.<container-id>, _pendo_visitorId.<container-id>, _zendesk_authenticated, _zendesk_cookie, _zendesk_session, _zendesk_shared_session, ajs_anonymous_id, cf_clearance
Analysis and Marketing Cookies
Analysis cookies enable us to analyze your activities on our website in order to improve and adapt the functionality of our website.
The marketing cookies can be set through our website by our advertising partners in order to create a profile of your interests and to show you relevant advertisements on other websites.
Google Analytics & Google Tag Manager
_gid, _ga_<container-id>, _ga, _gat_gtag_<container-id>
Google Ads & DoubleClick
test_cookie, _gcl_au