L2L VPN: 1 router fails, will remote router know to change routing?

[MicJameson1]

Hello.

If 2 enterprises have a basic vanilla ISAKMP L2L primary VPN, and enterprise ABC's router fails, will the enterprise XYZ router have any ability to alert its enterprise routers (whatever the routing protocol) that the routing should be changed to the backup VPN?

Thank you.

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118087-technote-asa-00.html

[MicJameson1]

Thank you MHM, your links are always so valuable.

[MHM Cisco World]

and you are so welcome any time

[balaji.bandi]

Clarify the question here -  ABC and XYZ have 2 VPNs - if one Primary go down you get alerts, yes you can make alerts of SNMP Traps (if you have any Syslog server)

its all depends on what routing protocol you use, and sure it will generate alerts in the syslog peer went down.

or you can setup an EEM Script to send emails also.

[MicJameson1]

Thank you for your reply.

Yes humans will get notified.

(this topic is relevant to a strategic discussion I had with a vendor, I'm confirming that I was correct or not.)

If a link fails within a network, any routing protocol will adjust the network to instantly recover-- (super easy / simple).

This link is different because the 2 AS only have a vanilla L2L ISAKMP VPN connecting them. So...

...Without using a BGP peering within the VPNs, and also without using an SLA, is there any other technology / strategy that, during a VPN router failure, will allow the remote network to instantly failover to the backup VPN?

Thank you.

[balaji.bandi]

...Without using a BGP peering within the VPNs, and also without using an SLA, is there any other technology / strategy that, during a VPN router failure, will allow the remote network to instantly failover to the backup VPN?

- without any Monitor or failover config (like any IGP / BGP )  or without any scripting/automation -  personally, I do not believe (until any manual intervention to change the config of routing manually)

- happy to hear that anyone invented magic auto failover (without any config ?)

- Only case I can think of both the Links are Active / Active (one fails other still pass the traffic)  ( like we do in the SD-WAN)

[MicJameson1]

To play the other side of the argument-- Is there some simple way through something like basic keepalives, that the remote router could tell its network that the tunnel is down, so don't send packets through it, but instead use another route?

(or is "something like basic keepalives" what is meant by a SLA. The point is , SLAs require a few elements, such as ACL's , route maps, policy maps, etc. I would think you could enter 1 simple command like "#alert peer down" that would tell the routing protocol to declare the route down. Is the complicated SLA (or BGP) the only available technology?

Hey Cisco, please create the command #alert peer down   !

[Rob Ingram · Accepted solution]

@MicJameson1 yes, dead peer detection (DPD) keepalives are used to determine whether a VPN tunnel is down.

Combine that with a routing protocol or reverse route injection (RRI).