VPN3k - Load balancing and routing between spokes

[m.laporta]

Hi Experts.

I'm designing a large-scale VPN3k-based hub-and-spoke network (about 400 spokes).

For redundancy, I need to use at least 2 VPN3k's in the hub, and I'm going to leverage the load balancing VCA feature.

The customer says that communication between two spokes might be occasionally needed. This easy to solve if I have only one VPN3k in the hub, but I'm wondering if it would still work with a couple of load-balancing 3k's.

What would happen if the two spokes terminate their tunnels on different hub 3k's?

Could RRI + RIP/OSPF + an additional router solve the problem? Or maybe the additional router is not needed at all (which would make the Customer happier)?

Any ideas are appreciated

Thank you

michele

[dlac455]

I'm not able to put a positive spin on this: it won't work. VPN3k's will not route between spokes. The VPN3k will spit the packet out the inside interface, instead of turning it around into the correct tunnel. Good luck!