WAN Failover Scenarios

Using Digi Wireless WAN Routers

February 2008 rev 1.1 Digi International 1 of 8

This document discusses several methods for using a Digi wireless WAN gateway to

provide WAN failover for IP connections in conjunction with another router designated

the primary route – for example connected to an MPLS network (see note 3 below).

Other options are available, but the ones discussed here are the most common. In these

easier to configure. This mode also supports IP Pass-through where the mobile IP address

is passed through to the router.

Failover via a LAN port is usually more difficult since a floating static route or similar

must be configured with a higher metric to redirect traffic to the Digi’s Ethernet address.

VRRP however is not overly complex and is designed specifically for failover.

It is important to note, that in cases other than VRRP, the Digi device itself normally does

not do anything to initiate or terminate the failover connection. It is up to the primary

router to redirect traffic in the event of primary WAN failure.

Also note that Digi wireless WAN gateways are designed to maintain an always-on

connection which helps facilitate quicker failover.

stores, banks, etc. where end-to-end encryption and/or tunneling are required.

3. Pass-through mode is where the Digi gateway connects to a designated WAN

Ethernet port on the router and some or all data is passed.

4. NAT Disabled: rarely used; static or dynamic routes are applied to the Digi

gateway. This is usually only possible where the carrier provides a private plan –

i.e., the traffic does not route via the Internet. IPsec VPN may be used if security

requirements, such as PCI compliance, require it. The examples below show the

more common VPN tunnel modes.

5. VRRP. Here the Digi device helps not only with “last-mile” failover, but can also

backup the primary router itself.

September 2010 rev 2.0 Digi International 2 of 8

gateway is used as the primary or only WAN connection.

Many carriers can provide private wireless plans where traffic does not touch the

Internet, thus providing more security. Check with your carrier for details.

3: Digi TransPort routers with four Ethernet ports (including those with embedded ISDN

or ADSL interfaces) can provide automatic failover from a primary (e.g. DSL) to a

secondary (e.g. cellular) without the need for an additional router. See the end of this

document for more information.

4: Remote out-of-band console management is also available using the Digi gateway’s

serial port(s).

NAT + IPsec VPN Split Tunneling

Here the Digi wireless WAN gateway itself builds VPN tunnels from the remote site to

handle the routing and failover (note the Digi gateway does not support VLAN itself).

In either case, the Digi gateway will likely need to protect and encapsulate the traffic with

IPsec. VPN policies on the Digi device might look something like (assuming the remote

site net is 10.128.5.0/24 and the Digi router supports 5+ tunnels):

September 2010 rev 2.0 Digi International 3 of 8

Why use this scenario? There are two primary reasons:

(a) The primary router is connected to the Digi wireless WAN gateway via LAN port

The major drawbacks are (a) multiple policies must be defined for each remote subnet*,

(b) there is less control of Internet traffic outside the realm of the VPN policies, and (c)

IPsec VPNs can add significant overhead due to IPsec encapsulation.

[* GRE is supported on some Digi routers such as the Digi TransPort. Routes can be

injected into GRE interfaces, which can then be encapsulated into IPsec if encryption and

authentication are needed. This would allow multiple subnets or IP address ranges be

routed via one IPsec tunnel.]

NAT + IPsec VPN Tunnel All Mode

“Tunnel All” mode is similar to the above, except that ALL traffic from the remote site is

tunneled back to the home office via IPsec – i.e., no split tunneling occurs. In the Digi

September 2010 rev 2.0 Digi International 4 of 8

Pros: All traffic is routed to the host network providing total control of Internet traffic

and enhancing security at HQ. Only one VPN policy is needed for the remote site.

Cons: All traffic is routed to the host network so more management and capacity is

required for routing, filtering and controlling Internet traffic at HQ.

NAT + IPsec Tunnel All 10.0.0.0 (or similar)

Here the Digi gateway allows extending the 10.0.0.0 network to 10.x.y.z remote subnets

(or similar network configuration). This would allow split tunneling of traffic outside the

10.0.0.0 network but with only one VPN policy similar to:

In this mode the Digi gateway passes the mobile IP address through to a router or VPN

device via Ethernet. The Digi gateway performs much like a bridge. An Ethernet port on

the attached device is designated as a “public” WAN port and assumes the mobile IP

address. This address can be assigned statically or via DHCP. In this case, the primary

router would likely terminate a VPN or GRE tunnel.

September 2010 rev 2.0 Digi International 5 of 8

Here the primary router/VPN device controls all traffic except for management traffic to

The primary router/VPN device must have an available port that can be designated as a

“WAN” port in a subnet separate from the remote site LAN network and the primary

WAN port(s). Low-end routers typically have no such option. This option is often used

for primary connections in temporary or emergency situations.

IP Pass-through mode provides management pinholes where the user can select protocols

such as SSH, HTTPS and telnet that terminate on the Digi wireless WAN gateway itself

to provide management functionality. iDigi remote management is also still available.

defined by RFC2338 (http://www.faqs.org/rfcs/rfc2338.html). Here the Digi gateway is

typically in “stand-by” mode until needed. The Digi device and primary router share the

September 2010 rev 2.0 Digi International 6 of 8

September 2010 rev 2.0 Digi International 7 of 8

management server at HQ. If the probes fail to get a response after n number of attempts,

September 2010 rev 2.0 Digi International 8 of 8