Show Posts
1
General Discussion / WAN Failover HowTo?
« on: October 17, 2018, 08:27:06 pm »
Hi all,
for our school campus (3 big schools) we'll get a new fiber-broadband connection. Additionally we'll keep our existing broadband-cable connection from Unitymedia (Germany).
Loadbalancing between these two connections would be nice to have but isn't subject of this thread. Main connection will be the fiber, because it's 1 Gbit/s symmetric.
But in case that one of the two connections will fail (fibercut or something else), I'd like to achieve automatic WAN-Failover. I'm wondering, how you would do that?
From inside to the internet, this could be done with OPNSense or - since the different schools use different firewalls - with a common used router in front, that does the WAN-failover, right?
But what about the other way: external access from the internet!?
Each school does have some fix IP addresses for different services (OWA, selfhosted clouds etc.). These IPs won't be transmitted from one (the broken) ISP to the other!
Is DNS-failover the right thing here? To have 2 IPs configured for each domain in the responsible nameserver?
I've read, that there are some obstacles with this setup because some clients would get obsolete IPs from caching DNS-servers and/or because some DNS-Providers won't take care of TTLs...!?
Besides that, one should decrease TTL in this scenario to achieve fast IP-switching but then the nameservers would be quite heavily loaded!?
Or am I completely wrong and one can achieve this on a completely different way?
Any thoughts or experiences?
Many thanks in advance and best regards,
cibomato
for our school campus (3 big schools) we'll get a new fiber-broadband connection. Additionally we'll keep our existing broadband-cable connection from Unitymedia (Germany).
Loadbalancing between these two connections would be nice to have but isn't subject of this thread. Main connection will be the fiber, because it's 1 Gbit/s symmetric.
But in case that one of the two connections will fail (fibercut or something else), I'd like to achieve automatic WAN-Failover. I'm wondering, how you would do that?
From inside to the internet, this could be done with OPNSense or - since the different schools use different firewalls - with a common used router in front, that does the WAN-failover, right?
But what about the other way: external access from the internet!?
Each school does have some fix IP addresses for different services (OWA, selfhosted clouds etc.). These IPs won't be transmitted from one (the broken) ISP to the other!
Is DNS-failover the right thing here? To have 2 IPs configured for each domain in the responsible nameserver?
I've read, that there are some obstacles with this setup because some clients would get obsolete IPs from caching DNS-servers and/or because some DNS-Providers won't take care of TTLs...!?
Besides that, one should decrease TTL in this scenario to achieve fast IP-switching but then the nameservers would be quite heavily loaded!?
Or am I completely wrong and one can achieve this on a completely different way?
Any thoughts or experiences?
Many thanks in advance and best regards,
cibomato