{{ $t('productDocDetail.updateTime') }}: 2026-04-29

This use case describes how to establish two IPsec VPN tunnels in active/standby mode between the HQ and branch devices, where the two tunnels preferentially route traffic over the link named WAN1.

Steps

Step 1.Create a VPN tunnel interface on each of the HQ and branch devices. Specifically, specify the name and IP address of each tunnel interface, and make sure that the IP addresses of the two tunnel interfaces created for the HQ and branch devices belong to the same network segment. In addition, select PING for Allow under Management Service. In this example, the two tunnel interfaces are named vpntun1, as shown in the following figures.

• VPN tunnel interface for the branch device:

• VPN tunnel interface for the HQ device:

Step 2.Create an IPsec VPN tunnel on each of the HQ and branch devices. Specifically, configure necessary parameters, and select the link WAN1. Then, click the Route Mode tab, and set Local Tunnel Interface to vpntun1.

• IPsec VPN tunnel on the branch device:

• IPsec VPN tunnel on the HQ device:

Step 3.Repeat Steps 1 and 2 to create another VPN tunnel interface named vpntun2 and another IPsec VPN tunnel. In the settings of this IPsec VPN tunnel, select the link WAN2, and set Local Tunnel Interface to vpntun2.

• Branch device:

• HQ device:

Step 4.Configure a link state detection task named "A" on the branch device. Specifically, on the PING tab, select Enable, and set Dst Address 1 to the IP address of vpntun1 created for the HQ device and Outbound Interface to vpntun1, as shown in the following figure.

Step 5.Configure a link state detection task named "B" on the branch device. Specifically, on the PING tab, select Enable, and set Dst Address 1 to the IP address of vpntun2 created for the HQ device and Outbound Interface to vpntun2, as shown in the following figure.

Step 6.Configure a link state detection task named "a" on the HQ device. Specifically, on the PING tab, select Enable, and set Dst Address 1 to the IP address of vpntun1 created for the branch device and Outbound Interface to vpntun1, as shown in the following figure.

Step 7.Configure a link state detection task named "b" on the HQ device. Specifically, on the PING tab, select Enable, and set Dst Address 1 to the IP address of vpntun2 created for the branch device and Outbound Interface to vpntun2, as shown in the following figure.

Step 8.Create a static route on the branch device. Specifically, set Dst IP/Netmask to the network segment of the HQ device and Interface to vpntun1, associate the static route with the link state detection task "A", and set Administrative Distance to 1, as shown in the following figure.

Step 9.Create another static route on the branch device. Specifically, set Dst IP/Netmask to the network segment of the HQ device and Interface to vpntun2, associate the static route with the link state detection task "B", and set Administrative Distance to 2. This way, traffic will be preferentially routed to vpntun1.

Step 10.Create a static route on the HQ device. Specifically, set Dst IP/Netmask to the network segment of the branch device and Interface to vpntun1, associate the static route with the link state detection task "a", and set Administrative Distance to 1, as shown in the following figure.

Step 11.Create another static route on the HQ device. Specifically, set Dst IP/Netmask to the network segment of the branch device and Interface to vpntun2, associate the static route with the link state detection task "b", and set Administrative Distance to 2. This way, traffic will be preferentially routed to vpntun1.

Step 12.Verify the result. The result shows that two IPsec VPN tunnels are successfully established, and business traffic is preferentially routed to vpntun1. If the link state detection fails due to a fault on the active IPsec VPN tunnel, business traffic is automatically switched to the standby IPsec VPN tunnel associated with vpntun2.

Specifically, a tunnel fault is intentionally triggered on the active IPsec VPN tunnel associated with vpntun1. As a result, the link state detection task A fails, and business traffic is automatically switched to the standby IPsec VPN tunnel associated with vpntun2.