Nebula - Use a Mobile Router as 2nd WAN Interface with failover and VPN Backup

In this article, we are going to learn how to use the NR7101 as a secondary WAN interface and VPN backup.

Prerequisites

You will need the following:

• Nebula compatible firewall (for example USG FLEX series which is used in this article)
• Nebula NR7101 5G mobile router

The first step is to add the mobile router to Nebula Cloud Control:

NCC - How to add a nebula Mobile Router into Nebula?

To distinguish if your model is compatible, please refer to the article below:

Mobile Router into Nebula - Hardware and Software Identification (LTE3301-Plus / NR5101 / NR7101)

Configuration

Congratulations, you now have your NR7101 up and running in Nebula, and can be monitored via the cloud, however, there is more that we can do than just monitor the device. We will walk through the configuration of dual-WAN and WAN failover and VPN backup with the steps below.

Make sure that you have set the correct ports in the firewall to match the cabling of the WAN setup.

Site-wide > Configure > Firewall > Port

In this scenario, we only want to use the mobile router as a backup due to for example data plan limitations, and we want to configure it as a backup interface. With these settings, the interface will not be used, unless the other WAN interface is unavailable. Please navigate to;

Site-wide > Configure > Firewall > Routing

To read more about routing and traffic shaping, please see the article below;

USG FLEX Series in Nebula - Routing and Traffic Shaping configuration

For VPN backup, most of the work is done by selecting the backup interface, as you are connecting to the Nebula domain which is visible on the VPN page. The domain will point to your both WAN IPs.

In this example, we will use secondary WAN backup for remote access VPN:

Site-wide > Configure > Firewall > Remote Access VPN

Please make sure that the WAN interface selection is set to "Auto"

Now the WAN failover and VPN backup should work.