MAT LAN/WAN Redundancy/Failover

[ITGURU]

As a MAT for a few years now all with site to site connectivity and cloud services, what is everyone doing for redundancy/failover if one site loses connection, with between site to exchange on lease line, or further within the providers network?

Are you utilising SD-WAN or alternative solution, so that if one site is down, the other sites are 'aware' and re-route traffic between them?

Alternatively, what solutions have you implemented whether it be manual or automatic failover between sites when they have traffic between them, as well as out to the internet.

[Mr.Ben]

We have 43 sites on an SD-WAN.

 

Each site has a leased line and an FTTC (with a few FTTP and FTTC).

 

2 different providers on each site.

 

We utilise both connections with rules so that VOIP and our network management is using the 'secondary' line and all other traffic on the leased line unless failover on either connection

 

We send some traffic direct (avoiding our cloud filter) - MIS, VOIP email etc.

 

If the primary line fails then only this direct traffic is allowed on the backup line - just to protect bandwidth.

[ITGURU]

What hardware are you utilising for the connections?

 

We have 43 sites on an SD-WAN.

 

Each site has a leased line and an FTTC (with a few FTTP and FTTC).

 

2 different providers on each site.

 

We utilise both connections with rules so that VOIP and our network management is using the 'secondary' line and all other traffic on the leased line unless failover on either connection

 

We send some traffic direct (avoiding our cloud filter) - MIS, VOIP email etc.

 

If the primary line fails then only this direct traffic is allowed on the backup line - just to protect bandwidth.

[Mr.Ben]

Fortigates with a Hosted Fortimanager.

 

We looked at lots of options, but price point brought it down to Fortis or Meraki for what we needed.

 

Fortis have more functionality which suited us.

[dmj]

We run all the infrastructure in gcp, so there is no need for us to route traffic between sites.

[Mr.Ben]

We run all the infrastructure in gcp, so there is no need for us to route traffic between sites.

We don't have any reason to either, except for ease of use.

 

We have a tech vlan that can be VPN'd to to access printers and network gear without piggybacking off of a remote device.

[Wave9_Lee]

We have 43 sites on an SD-WAN.

 

Each site has a leased line and an FTTC (with a few FTTP and FTTC).

 

2 different providers on each site.

 

We utilise both connections with rules so that VOIP and our network management is using the 'secondary' line and all other traffic on the leased line unless failover on either connection

 

We send some traffic direct (avoiding our cloud filter) - MIS, VOIP email etc.

 

If the primary line fails then only this direct traffic is allowed on the backup line - just to protect bandwidth.

This is pretty much what we recommend (except we use Sophos XGS). Lots of flexibility, cost effective, highly resilient. We use alternate ISP & technoloy where possible for the backup connections but manage it all under one SLA. For added resilience a second appliance can be added at each site for failover (only one licence cost) but they're pretty bullet proof and we offer a 6 hour on-site configured replacement anyway.