IPSEC HA - dual LINK(ISP)

[J_Vansen_S]

Hi,

I would like to verify my setup. If this is achievable in terms of IPSEC HA failover.

Apparently the VPN headend is a 3925ISR.

Primary link to remote sites will be via ISP 1 Direct lease line.

If any of the lease line to/fro the remote site breaks, the tunnel will fail over to ISP over the cloud.

Thus on my ISR3925 i will be needing to configure quite a few number tunnels for my remote sites

Am i on the right track?

[Karsten Iwen]

The HA is easily done. You build two tunnels (VTI/FlexVPN) per spoke to the HQ-Router (or routers) and run a routing protocol through the tunnels to prefer the primary link. If the primary link fails, the routing protocol will converge to the tunnel over the secondary ISP.