VPN Stability or Failover - with MX - WAN Internet1 and 4G

[SCC]

Hi All,

I would like to know if we can have a stable VPN to my remote site from MX having Failover to 4G

if the main internet connection drops will my VPN still remains up without any fluctuations when it failover to the LTE/4G.

[PhilipDAth]

If you use a USB 4G failover there will be a disruption.  It depends a little on how quickly it takes the 4G connection to come up, but you could expect a 30s outage after the primary WAN circuit failure is detected.

If you can't live with a failure this long then you'll need to use a 4G router and plug that into the second WAN port of the MX so that both of the circuits are always up.  Then AutoVPN can be permanently built over both of the circuits.  If you have bothj circuits up all the time you can also use SDWAN to failover in poor performance, rather than in just the case of a complete outage.

This document has some configuration examples so you can get an impression of how this can be configured.

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/...

[NolanHerring]

@PhilipDAth 

I can't seem to find anything about the built-in cellular options with the MX67C/68C models.

I can see in the documentation the following:

Is dual active AutoVPN available over a 3G or 4G modem?

No, 3G or 4G modem cannot be used for this purpose. While the MX supports a range of 3G and 4G modem options, cellular uplinks are currently used only to ensure availability in the event of WAN failure and cannot be used for load balancing in conjunction with an active wired WAN connection or VPN failover scenarios.  

This answer seems 'old' and in response to the USB based cellular modems.

Assuming the built-in cellular also has to build the tunnel, but only when WAN1/WAN2 go down (the way it does for USB based cellular)?

[PhilipDAth]

@NolanHerring , "I can't seem to find anything about the built-in cellular options with the MX67C/68C models"

The options are exactly the same.

The AutoVPN failover when using USB (or built in) 4G failover is not dual active.  But AutoVPN will 100% kick in over the 4G circuit once the primary circuit has failed.

[Zilla]

If you are using a USB cellular or the embedded cellular modem in the MX i don't think you can.  However, if you have a Cradlepoint or other 4G/LTE router plugged into WAN2, you can do that.  

We learned from our SE that you can have Meraki Support apply the cellular failover rules to WAN2 so you can control what goes out over the cellular device.

For sites where we do this we have WAN1 as the primary uplink, load balancing turned off, and have the Active-Active VPN set to disabled to save on cellular use.  We take a brief hit while the new tunnels come up, but in our use case that's OK.  If you can't take the hit you may want to enable Active-Active VPN, but you will consume more cellular data (use at your own risk).