ipvpn tunnel configurations

[yeow_km]

i have a core router that contains ipvpn tunnel configurations with my site office branch router.

recently while setting up a new site, we test the link failover.

we discovered that the tunnel from site router to core router remain down after we shutdown the main link with only the backup link as the failover didnt take place.

what is the best practise for configuring ipvpn site to site tunnel configuration?

after we removed the keepalive setting on the core router, my tunnel was able to get connected.

core router (C3925 router)

interface Tunnel1003
description Tunnel to site3
ip address 10.205.5.9 255.255.255.252
ip mtu 1500
ip virtual-reassembly in
ip tcp adjust-mss 1436
ip ospf message-digest-key 1 md5 7 070C2XXXXX

keepalive 10 3 ---- removed 
tunnel source 172.30.100.1
tunnel destination 172.30.3.1

site router (C1941 router)

interface Tunnel1003
description Tunnel to Core1
ip address 10.205.5.10 255.255.255.252
ip mtu 1500
ip virtual-reassembly in
ip tcp adjust-mss 1436
ip ospf message-digest-key 1 md5 7 070C2XXXXXX
keepalive 10 3
tunnel source 172.30.3.1
tunnel destination 172.30.100.1

[Philip D'Ath]

I seen this happen before with buggy IOS versions.  Which ever router you removed the "keepalive" line from is the one with the buggy software.  You should upgrade it to the next "gold star" release.

The other possibility is that you have recursive routing going on.  I can't tell without see a lot more config.

The really important bit is that if you are using dynamic routing protocols that the tunnel endpoints (172.30.100.1 an 172.30.3.1) are never advertised over the tunnel itself.

[yeow_km]

ios for the c3925 is C3900-UNIVERSALK9-M, Version 15.2(4)M5

and C1900-UNIVERSALK9-M , Version 15.2(4)M6 for the c1941 router.

looks like i need to upgrade the ios.

[Philip D'Ath]

I would recommend either 15.4.3M5 or 15.5.3M2.

[yeow_km]

i have bgp running on 1st WAN link and backup WAN link for this tunnel.

how can I configure the router such that if 1st WAN link down for more than 5 mins, the 2nd WAN link can take over the traffic ??

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Do/PfxRcd
117.xx.1xx.2xx 4 9255 33762 34477 1066 0 0 1w3d 43
117.xx.1xx.2xx 4 9255 7763 7953 1066 0 0 2d12h 43

[Philip D'Ath]

5 minutes is a long time.  You would have to extend the BGP timers to make it that long.  Do you really need it to take that long?

[yeow_km]

5 mins is just an example.

can the router resume normal traffic using the 1st WAN link when it is back if it went down due to cable fault ??

can i use the BGP timers to control this ?

[Philip D'Ath]

When the primary link comes back up again BGP will re-establish, and the original routing table should restore itself.

You don't need to touch any BGP timers.