GRE tunnelling

[godwinjms009]

I want to create two GRE tunnel between my DDOS mitigation box and two routers.

The set up contains a primary and secondary router working in active passive mode.

How i will be able to create a gre tunnel by enabling HSRP so that when the tunnel in primary router fails then only the secondary router tunnel should come up???

[Richard Burts]

I believe that it is not possible to implement GRE tunnels in the way that you describe using HSRP. I believe that you can achieve the primary/backup relationship between the tunnels using a different mechanism. Does your DDOS mitigation box support a dynamic routing protocol? If so you could run a dynamic routing protocol over both tunnels and manipulate the routing metric so that one tunnel is preferred and the other tunnel is used only if the primary fails. If the DDOS mitigation box does not support a dynamic routing protocol then you might on the primary router set a static route with the tunnel remote IP as the next hop, redistribute that static into your routing protocol running on both routers, and use tunnel keepalives or perhaps IP SLA tracking to monitor status of the tunnel and withdraw the static route if the tunnel fails. On the backup router you would configure a floating static route. As long as the dynamic routing protocol advertises the redistributed static from the primary the floating static is not used. But when the redistributed static is withdrawn only then is the floating static used and the secondary tunnel is used.

HTH

Rick

[Alex Sanchez Jimenez]

The only possible way is if the tunnel goes down completely, by that I mean a up/down state, if this happens you can use tracking for that interface Tunnel state and decrease the HSRP priority on the router where the tunnel fails, using preempt on the backup router it will allow it to take the primary roll and have the traffic use the tunnel configured on it. If this condition is not met where the tunnel changes the state to down the failover won't occur.

Here is the configuration guide where you can find a little bit more about tracking for HSRP.

http://www.cisco.com/c/en/us/support/docs/ip/hot-standby-router-protocol-hsrp/13780-6.html

P.D. You need to routers with one tunnel each one so you can run HSRP between them.

Hope this helps.

Thanks,

Alex Sanchez

CCIE R&S #37454