Dialbackup for IPSec tunnel?

[jason.aarons]

How can I monitor a IPSec tunnel on a IOS Router 2600XM, and if the tunnel is down bring ip a isdn "dialer interface" ?

currently I have

interface fa0.1

des internet cable modem

encap dot1q 1

ip addr 24.24.23.1 255.255.255.0

crypto map IPSecTunnel

!

interface fa0.2

description Internal LAN

encap dot1q 2

ip addr 10.0.0.1 255.255.255.0

!

ip route 0.0.0.0 0.0.0.0 24.25.20.1

ip route 0.0.0.0 0.0.0.0 dialer1 220

But the dialer never goes up because the route never goes down when the Internet core has problems. I've found a dialer only works if the physical ethernet goes down. What about if the IPSec peer is unreachable?

[Richard Burts]

With IPSec tunnels it is difficult to trigger changes based on losing connectivity to the remote peer. I faced this challenge in a network for a customer recently and found a solution using GRE tunels, with IPSec over the tunnel and a dynamic routing protocol over the tunnel. If the dynamic routing protocol advertises a default route, it is feasible to configure a floating static route for the default route which would use the dialer only if the dynamic route from the peer is removed from the table.