PIX conditional routing

[scolombo]

I've the following scenario.

A corporate site and a branch site .

On each site an ADSL , CDN ,and Satellite connections

ADSL connects to a ISP for internet access.

CDN and Satellite connects the two sites.

Customer asked for :

VPN being enabled through ADSL and Satellite to connect the two sites.

VPNs must be used concurrently and ,when needed , be the backup of the other.

In normal condition traffic should be directed to each vpn based on protocol and port type.

Is conditional routing supported on PIX?

Hope anyone can help me with this scenario

Thanks

Stefano Colombo

[ehirsel]

Although you can run routing protocols such as rip and ospf, the network routes which make up the contents of the routing updates, are the same over each vpn connection (adsl and satellite). What is not contained in the updates are the ports and protocols used. Thus using routing metrics by themselves is not enough to get the conditional routing because one path will always be favored over the other.

Is there a router as well as a pix on both the remote and corporate site?

If so, what you may need to do is configure two IPSec tunnels and one GRE tunnel. These have two purposes: one will be the over which path to reach the remote router (adsl or staellite) and the other will be act as a vpn gateway. This way the same local router will always act as a vpn gateway for the intersting traffic (use extended acls to spec the port/protocol) and the router will make the determination of best how to get there. GRE traffic is not processed by the pix, but can pass thru it. The reason for the two ipsec tunnels to to segment the traffic by port/protocol.

The same two routers can advertise the same info over the two links, so that they can reach each other and make it transparent to the users. This simplifies the pix config - all the pix will need to do is to encap the rotuer-to-rotuer GRE traffic in IPSec form over the ADSL session to the other pix.

Let me know if this helps.