Active Active site to site VPN tunnel with asymmetric routing

[Aaida]

Please provide solution for below requirement: attached diagram for this scenario please refer .

 We need to implement site to site vpn with 3rd party. both of us having two peer IP. our primary peer is connecting to their primary peer, and our secondary peer is connected to their secondary peer. Also both tunnel should be active at a time. there are two 3rd party servers are there in use. One is in DC 1 and other is in DC 2. Hence when our user want to connect with A.A.A.A servers it should flow trough tunnel A. like wise when user connecting to B.B.B.B it should take tunnel B. Also traffic should fail over properly when one goes down. what is the best possible way to achieve this.

tunnel version: ikev2

Questions: 

1. Which is the most appropriate tunnel mode? policy based or route based VPN, else the above requirement can be full filled with either of this .
2. What should be the routing strategy. we are thinking of making the 3rd party servers part of BGP , and make use of BGP prepend attribute to do asymmetric routing .is that a good solution.
3. Are we able to do auto failover with this set up.
4. is it possible to try this set up in LAB and get a sample configuration as we don't have a lab environment.

[M02@rt37]

Hello @Aaida,

Thanks for sharing the HLD.

Route-Based VPN Route-based VPN is generally more suitable for complex scenarios like yours, where you need granular control over the routing of specific traffic. It allows you to create multiple tunnels between the peers and control the routing based on various parameters.

BGP with AS-Prepend Using BGP is a good approach for dynamic routing and achieving failover. You can configure the 3rd party servers to participate in BGP and use AS-Prepend to influence the routing decisions. By prepending your AS number multiple times to the announcements, you can make one tunnel the preferred path for traffic to A.A.A.A servers and the other tunnel the preferred path for traffic to B.B.B.B servers. With the combination of route-based VPN and BGP, you can achieve automatic failover. BGP will continuously monitor the reachability of the 3rd party servers, and in case one tunnel or server goes down, BGP will adjust the routing accordingly. This way, traffic will automatically flow through the available active tunnel.

[Aaida]

Thank you, it is help full, so to be clear.

The mode should be route based VPN . Also auto failover can be achieved just by creating BGP prepended configuration. Please let me know any other key config required achieve my goals.

[MHM Cisco World]

[Aaida]

Hi @MHM Cisco World , Is there any issue with routing separately , with out passing through primary for server B.B.B.B

[MHM Cisco World]

I dont get your last reply totally 
but 
the red line I add to your topology need for redirect traffic from one router to other 
so are there any interconnect between routers?

[Aaida]

yes those are interconnected. but we dont want want to send traffic for server B to router A1 first and then router B1. We want to send server A traffic to Server router A1 and Sever B traffic to router B1 directly

[MHM Cisco World]

no need to send, the redirect only happened on client side 

[MHM Cisco World]

I will share lab with you the config how should be 

[Aaida]

that will help , thank you so much

[Kanan Huseynli]

Hi,

the main question, where is gateway for the subnet? How do you plan to route towards DC1 or DC2 till the traffic reaches routers. Are router A1/B1 the same device?

[Aaida]

Hi @Kanan Huseynli , both a1 and b1 are separate devices, if we advertise server A in router A and server B in Router B BGP , it will propagate to other routers. in this way corresponding traffic will reach corresponding router. using BGP prepend we can prioritize route and this will help for auto failover.

[Kanan Huseynli]

As-path prepend and also any other routing manipulation has meaning when you advertise the same route.

You advertises different routes / prefixes  , don't you? If you advertise different routes, you should have different mechanism to reach DC servers. And i general how users try to reach remote server? By hostname (DNS) or by IP in URL or what?