Configure VPN Ipsec as backup route

[reynaldolopeza]

Hi everyone, please your help with this issue.

We have access to branch offices through a Service Provider MPLS network. We have configured EIGRP over GRE tunnels for routing to Branch offices. Now we need to configure a VPN Ipsec as a backup route. I am aware that Ipsec only supports unicast traffic and static routes (no EIGRP allowed there).

How can I configure my routes in order to keep the EIGRP through the WAN network as the primary route and the new VPN Ipsec as the backup? We need high availability there.

Is there a way to configure EIGRP through Ipsec so I can configure delay and bandwith to change metrics and get my HA?

It's worth to mention that at HQ I have a Firewall ASA for Internet access and VPN configuration, and a router 4331 to connect to the WAN (no security license), and in my branch offices I have 4321 routers with Security license ready for VPN Ipsec configuration. I am attaching the network diagram. Thanks in advanced.

[Flavio Miranda]

Hi @reynaldolopeza

It depends on how EIGRP receives the routing. You can configure a floating static route on the core point to VPN.

If you loose your MPLS link you'll be send to VPN link.

 You can also think in IP sla but the first option would be better.

-If I helped you somehow, please, rate it as useful.-

[reynaldolopeza · Accepted solution]

I resolve the issue. Testing the HA shutting down the MPLS link, the IPsec tunnel automatically turns on. And when the MPLS link is back, the traffic retake the EIGRP route configured. For the traffic to use the Ipsec tunnel we just configured a default static route (the same one that allows my users to go out to the internet).

It was a routing issue.

Regards.