Hi guys,
I hope that someone can give me an answer or better a solution.
We run actualy crypto map based VPN´s which are using a virtual HSRP address
(between 2 2921) as source. It works fine since several years, but the
2921 are old and so we want to move the VPN´s to 2 4451 which are terminate many other route based
VPN´s but actually no policy based VPN´s. The redundancy for the route based VPN´s is realized on the routing layer via OSPF/BGP.
So our idea was to remove the crypto map and uses VTI for the policy based VPN´s also
and I´ve found a Howto on the CISCO side. This works as expected, as long as we use the
IP on the physical source interface. For redundancy purposes we want to use a virtual HSRP
address as the source for the "policy" based VTI´s, because we have no chance to use a dynamic routing protocol.
I´ve build a LAB on CML to simulate this. If I use the HSRP address as the source of the VTI, I can see that the router sends Packets out with the right IP, and the other side answer of course, but it looks like that our router don´t recognized the answer packets....
So does anyone know if this is possible....?
many thanks....
