IPSec Site to Site VPN in HSRP environment

[Sandesh Pudasaini]

Hello,

I am trying to do IPSec site to site vpn between to sites  that is Site A and site B as described in diagram.

Please assist how to deploy VPN in this secnario. Both site has virtual IP address of HSRP. 

Do we need to create VPN parameters in both routers i.e Site A (R1 and R2) and Site B (R3 and R4).

Hoping for optimize and ideal solution for this scenario. Which routing protocol should be run as i have configured static route.

[Deepak Kumar]

Hi,

I never tested this is in labor real life. Why are you configured HSRP on WAN interface? Is there any internal server published on the WAN?

As per my understanding, you required two VPN tunnels from each router. One VPN will be terminated from R1 to R3 and R1 to R4 and vice versa. You have to configure for same from R2 also. You can use IPSLA from monitoring routing for the VPN. 

I am not sure a VPN group will help in this case. Let me try in a lab and will come back on tomorrow.

Regards,

Deepak Kumar 

[Sandesh Pudasaini]

Hi Deepak,

Is there any issue with design consideration, please suggest. Or would it be possible to put R1 and R1 in HA ? 

[Deepak Kumar]

Hi,

My suggestions are below:

Configure Dual HUB DMVPN with IPSec protection setup and run the OSPF or EIGRP. 

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/41940-dmvpn.html#dualhubsingle

It is tested in my lab and will work.

Regards,

Deepak Kumar