cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Community Helping Community

886
Views
0
Helpful
0
Replies
Highlighted
Beginner

Policy based routing - Source Interface

Hello,

Currently, my company has the need to support a legacy PSK authenticated DMVPN tunnel and a new PKI authenticated DMVPN tunnel.  Ideally, both tunnels will terminate on the same Cisco 2951 router.  Since the router is a termination point for the VPN spokes, I would need 2 "default routes".  The source IP addresses of the spokes will be dynamic (personal grade ISP connections).

Both interfaces (and underlying tunnel interfaces) work when I switch the default route from one conncted interface, to the other.

Is it possible to use PBR to force traffic that entered on one interface to exit only on that same interface?

=======================================================================================

Example:

All spoke configs have ISAKMP/IPSec settings to terminate PSK tunnel on 1.1.1.1 and terminate PKI tunnel on 2.2.2.2

1.1.1.1 - NAT'd to 172.25.0.25 by ASA

2.2.2.2 - NAT'd to 172.25.25.20 by ASA

interface Port-channel1.172

description ** PSK Interface **

encapsulation dot1Q 172

ip address 172.25.0.25 255.255.255.0

interface Port-channel1.225

description ** PKI Interface **

encapsulation dot1Q 225

ip address 172.25.25.20 255.255.255.0

Below, only one route is entered at a time.  Interface and underlying tunnel work depending on which default route is added.

ip route 0.0.0.0 0.0.0.0 172.25.0.1  <==== When configured, only the PSK interface accepts VPN tunnel connections

(ip route 0.0.0.0 0.0.0.0 172.25.25.1)  <==== When configured, only the PKI interface accepts VPN tunnel connections

=========================================================================================

- Ideally, all traffic that ingressed on Po1.172 and was destined for an unknown IP (0.0.0.0 0.0.0.0) would forcefully have it's next hop set to 172.25.0.1

- Then, all traffic that ingressed on Po1.225 and was destined for an unknown IP would forcefully have it's next hop set to 172.25.25.1

Is this possible with PBR?

Everyone's tags (3)
CreatePlease to create content
Content for Community-Ad
FusionCharts will render here