Design for WAN - What would you do?

[carl_townshend]

Hi Guys

I have a question about a WAN design that we currently use and have an option to change if needed.

We have an MPLS with about 20 sites, on each site there is an MPLS router, and the backup router we run a gre tunnel over the internet.

The primary uses OSPF, and the backup router has static routes with a higher AD.

We have a full mesh of gre tunnels manually created between all the sites, so when we add a new site it can be a pain to manually create all the config.

However it is very stable and we get no issues.

We have a new site coming on board and an opportunity to maybe change the design for this site.

I was thinking DMVPN as we have 2 hubs, the only issue is if we lost both hubs, the other sites would not be able to communicate with each other like they do now.

Also, during the migration phase, if we start the new site on the dmvpn, then all traffic will have to be routed via the hub until all the rest are done.

What would you do in this situation, stay as is or move to dmvpn?

cheers

[Elliot Dierksen]

I would go with DMVPN. The level of manual configuration will continue to go up as you add more sites. It is true things would have to go to the hub for spoke to spoke communication during the transition phase, but you said this was a backup connection to you primary MPLS path so that shouldn't be a big deal. Once the hubs are set up in DMVPN, there are no config changes when you add a new spoke. That is all learned via routing protocols. You should create a template for what is required to add a spoke, and then you should be able to complete that process very quickly.

[carl_townshend]

Hi Elliot

The backup path lands on the main MPLS router in our hubs also, it just has a static route with a higher metric than the ospf route learnt over the mpls connection.

Can you confirm what would happen if we did lose both hubs? would we then lose the ability to route anywhere for all the remote sites ?

[Elliot Dierksen]

I am hesitant to give you absolutes here because I don't have a good understanding of your network. Here are some more specific questions.

If everything is up and and operating properly, is your primary path MPLS or VPN?

Is your side of the MPLS (The CE router) the same device that terminates the existing VPN connections?

If you have a high level topology drawing, that would be very helpful to understand your network better.

[Flavio Miranda]

Hi

  Honestly, I think you should start thinking in SDWAN.  SDWAN will allow you to keep the MPLS and the Internet and benefit from both, using only one physical infrasctructure. Or, you can save tons of money by using only internet.

[paul driver]

Hello
I would suggest to go with DMVPN as others have stated , It will be a struggle at first to get it up running and your backup traffic for these tunnels would have to traverse through the new DMVPN hubs but when its migrated the benefits will be seen as the administrative burden of onboarding a new spoke site would be very simple.