How to redundant VPN

[joe.groess]

I have two sites with 2921 IPSec Routers. Each router has 3 ethernet interfaces. One LAN, one Internet, and one Ethernet based private circuit.

I need to do site to site VPN between these routers, over the private circuit. However, that circuit fails on rare occation, so I want to have a failover VPN to go over the Internet as a backup.

It doesn't matter to me if it's primary / secondary failover or if it's load balanced with failover. What is critical is if one circuit fails, my remote site continues to communicate with the main office.

HSRP looks like I need two routers and the HSRP protocol monitors multiple LAN interfaces, and I only have the one.

I've opened a case with TAC, but it's been a week without any progress.

Surely this isn't that difficult to do.

[joe.groess]

Thank you so much for your help. I am so relieved to see this working in my lab, I finally feel like I'll be able to impliment this.

[olpeleri]

Joe,

It has been a good learning opportunity.

I'm glad to know it's now working in your lab.

Good luck with your deployment.

Regards,

Olivier,

[ALIAOF_]

Tunnel IP's usually are totally different and people just use a /30 for the tunnel IP for instance:

Router1

interface fa0/0 (WAN)

ip address 1.1.1.1 255.255.255.248

!

interface fa0/1 (LAN)

ip address 192.168.1.1 255.255.255.0

!

interface tunnel0

ip address 10.10.10.1 255.255.255.252

tunnel source fa0/0 (This is your WAN interface)

tunnel destination 2.2.2.2 (This is Router2's WAN IP)

Router2

interface fa0/0 (WAN)

ip address 2.2.2.2 255.255.255.248

!

Interface fa0/1(LAN)

ip address 192.168.2.1 255.255.255.0

!

interface tunnel0

ip address 10.10.10.2 255.255.255.252

tunnel source fa0/0 (This is Router 2's WAN interface)

tunnel destination 1.1.1.1 (This is Router1's WAN IP)

Now this is just a very basic high level overview for an example.  I'd also suggest making this more secure by using tunnel mode ipsec ipv4 and creating an IPSec profile.

[joe.groess]

Thanks Cassius -

I Think I'm starting to understand this.