Redundancy for IPSEC

[ziby]

I have IPSEC tunnel connection between two sites. Tunnel is established between two Pixes 506E. Each site has addditionally ISDN router behind the PIX. I would like to use ISDN as a backup in case of ipsec tunnel failed. How I can monitor status of the tunnel and make ISDN router to detect tunnel failure and activate connection.?

(ISDN router------PIX506--------ipsec tunnel---PIX506--------ISDN router)

[jfrahim]

Hi there,

I would say, configure a GRE tunnel between the ISDN routers, and then encrypts that GRE stuff within IPSec. This way you could monitor the routes coming over the GRE tunnel and make them prefered routes. If the tunnel stops working and you stop getting the routes, then ISDN will kick in for the routes on the remote subnets

Jazib

[ziby]

Thanks

I will try this solution. It sounds pretty good.

[vcjones]

This challenge is addressed in the redundant VPN white paper on my web site (www.networkingunlimited.com/white009.html). It includes an example configuration for exactly the scenario you describe.

Good luck and have fun!

Vincent C Jones

http://www.networkingunlimited.com

[ziby]

Thanks for help.

document on networkingunlimited page is explaining everything very clear

thanks again