Most of our WAN uses EIGRP for routing. Up to now most of the connectivity to our major sites has been primarily via PTP circuits with LAN to LAN IPsec VPN tunnels serving as backup - either via CVPN 3000 to CVPN 3000 or CVPN 3000 to a Pix of some sort. I put in floating static routes with a higher metric so if a WAN circuit goes down the floating static points the traffic to the CVPN concentrator and the tunnel comes up. Works like a champ.
But now I want to do the opposite. I have two sites with big pipe (each with two DS3s) and I want the VPN to be primary and the WAN to be secondary.
But how can EIGRP be best notified in the event that the tunnel goes down?
One way I thought of was to create a GRE tunnel terminated at the WAN router inside the CVPN of each side. If the CVPN-CVPN IPsec tunnel went down - the GRE tunnel interface would go down and then the (artificially weighted higher) WAN circuit could kick in. But then I have wondered if GRE inside of IPsec might not be the best mechanism.
Anyone have some other ideas to get the CVPN-CVPN tunnels to play into EIGRP routing?
