IPsec Over Backup Cellular

[CSCO12093326]

Would we go about setting up an IPsec tunnel the same way as I would over the primary connection. I have a backup Cellular Interface and want an IPsec tunnel to be triggered only when the primary goes down. I have the primary being tracked with IP sla and tracking statements.

I am in a Cisco Router. Not and ASA.

Any suggestions on this. Thank you much.

[Marcin Latosiewicz]

depending what your existing configuration is you can do different things.

Crypto maps - use route tracking to point routing via the other interface should the primary one fail (you can use specific routes or default one, up to you). Peer on remote end either terminates on dynamic crypto map or applies two different peers under same crypto map entires.

VTI/GRE - use separate VRF for second ISP and rely on routing to send traffic to one or another (benefit is that both tunnels can be operational at the same time).

Plenty of others, but best failover is your routing protocol.

M.

[CSCO12093326]

Thank you. I am a little fuzzy on the VRF but wont take long to get with it. This was very helpful. I will post back once I am able to test this. Thank you.