Virtual routers

rvr_76bg · ‎12-17-2012

Hello guys,

I am not even sure this will work but let me give it a try. I have a client that wants me to bring up 2 VPN tunnels from my company to 2 Data Centers of the client – meaning 2 parallel Tunnel between us and the client. So over both Tunnels the client will access same resources on my side and they want failover option, when 1 tunnel is down to re-route over the 2^nd automatically. Automatically means I have to use a routing protocol to detect what path is available at the moment. That is forcing me to run routing between my sites as well ( WAN routing I already have of course) over the tunnels. So I will have something like 4 points in a square that will route between them. This is not really complicated. The complicated part is coming with the fact the client wants me to cover ISP failures which is fine since I am already multihomed and device failure meaning I have to have 2 devices per site (whatever I pick – ASAs or Routers). Do we have a technology that will make 2 routers to work like one? Something like Active/Standby in ASA? Because I have to have them covering the same tunnel ( sourse and destination for the VPN tunnels have to be virtually covered like Active/Standby in ASAs) so no one of the Standby protocols available in routers are applicable here. Let me know if you want me to attach a basic diagram…

Thanks in advance!

rvr

danabersoch · ‎12-17-2012

You will probably get away with using VTI's or GRE based IPsec tunnels and then running a routing protocol over it, if one of the ipsec tunnels is down then there won't be any routes over that tunnel, leaving the route down the 'other tunnel'.

Try looking through the document below:

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gtIPSctm.html

Collin Clark · ‎12-18-2012

I would select a router as there is lot more flexibility in what you can do. Take a look at DMVPN and reverse-route injection (RRI). One of those should work for you as well as VTI.

Marwan ALshawi · ‎12-18-2012

This can be done using DMVPN with dual hub design and from client end they need one tunnel
This need a cisco router nit asa
Have a look at this document I posted previously on CSC it's good place to start with
https://supportforums.cisco.com/docs/DOC-8356

Hope this help

Sent from Cisco Technical Support iPhone App

rvr_76bg · ‎12-19-2012

Guys, thanks very much, all this is very very helpful.

Cheers,

rvr

Marwan ALshawi · ‎12-19-2012

happy to help and please rate the helpful posts