Site to Site VPN Design Question

[dcanady55]

Hello,

FTD 2110 running 7.4.1.1

I am wondering if the following is possible:

Current setup:

• Datacenter A has two FTDs in HA with an existing internet connection.
• Datacenter B has two FTDs in HA with an existing internet connection.

We already have failover if Datacenter A goes down and we need to use Datacenter B’s internet. However, we have a lot of resources at Datacenter A that users need when Datacenter A goes down. Is it possible to bring in another internet connection at Datacenter A and create a site-to-site VPN tunnel between the FTDs at Datacenter A and Datacenter B? If Datacenter A goes down, traffic would route to Datacenter B for internet access, but if users need to access local resources, we could send them across the site-to-site tunnel. I’ve created a site-to-site VPN between Datacenter A and Datacenter B before, testing out other ideas, but I was using those locations’ existing outside interface and internet.

Thanks for any feedback

[Rob Ingram · Accepted solution]

@dcanady55 yes you could configure a VPN between DC A and DC B, user traffic is routed from the branches to DC B and onwards to DC A via the other VPN.

[dcanady55]

Thanks Rob. I will accept this as a solution and if I have any issues will report back on this thread for others to learn. 

[MHM Cisco World]

How if DC-A down the VPN still UP?

You need DC interconnect and not need VPN to make traffic from DC-A forward to DC-B

MHM

[dcanady55]

I could be misinterpreting your question MHM but the overall location A fine but if our internet goes down the WAN also goes down as there riding the same fiber. In so, instead of enacting a full-blown DR failover at B if it's only going to be a few hours it might be easier for us to bring in a cheap internet connection into A using another provider and then run this site to site from B to A so that users can get to those local resources at A. Sounds like that's doable according to Rob so thanks for the feedback.

[MHM Cisco World]

So you will have second ISP in each site' and that solve issue not VPN.

MHM