VPN On Demand (10.7.2+)

Welcome to Ecessa Support, we have a variety of technical information and tools for a variety of solutions. If you aren't finding a solution, or would like to talk to a technical support team member, please call 800-669-6242.

See Ecessa's full line of products and solutions

The VPN “On Demand” start option is introduced in firmware version 10.7.2 and allows the Ecessa device to bring up a VPN when interesting traffic is seen. This is different than the VPN behavior in prior firmware versions which only acted as an “always on” VPN.

 Here is an example of a site-to-site VPN:


The “always on” VPN will constantly monitor the VPN tunnel and if it detects the tunnel is down will attempt to re-initiate the tunnel to bring it back up. It does not matter if any LAN-to-LAN traffic is being passed between the VPN gateways at the time.

However, the On Demand option will not immediately bring up the VPN tunnels once the VPN Security Association is started/enabled, the VPN service is enabled, or the device is booted.


Instead, the VPN will be in the “running” state and will listen for any interesting traffic - in this example, traffic between the local LAN of and the remote LAN of In the event such a packet is seen by the Ecessa device, it will immediately try to bring the tunnel up so that the encrypted traffic can flow.


 The VPN can also be brought up manually by selecting the VPN and clicking the Start button. If the primary WAN link is down, the device will fail over and build the tunnel over the secondary WAN instead.


Why use On Demand instead of Always On?

 On Demand is useful when building a VPN with a Cisco or other vendors’ device which has connection timeouts or when it is preferred the VPN only gets built when it is necessary to pass the interesting traffic.


When can On Demand be used?


Single local, single remote WAN

Multiple local, single remote WANs

Single local, multiple remote WANs

Multiple local, multiple remote WANs

On Demand


 Ecessa to non-Ecessa VPN




 Ecessa to Ecessa VPN



Always On


 Ecessa to non-Ecessa VPN



 Ecessa to Ecessa VPN





Can IKEv2 be used with On Demand?

Currently, On Demand can only be used with IKEv2 for single local, single remote WAN VPNs. IKEv1 is used for On Demand VPNs with multiple local WANs and single remote WAN. Always On VPNs support IKEv1 and IKEv2.


How is On Demand configured?

 On the main VPN page

 Confirm IPSec VPN Failover Testing is enabled:



On the VPN Security Association Basic page


Enable Dead Peer Clear under Dead Peer Detection Options section. The DPD timeout and number of test can be left as defaults or changed to match the other side of the VPN.



Enable On Demand under the Start Option section




Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request


Article is closed for comments.