Cisco 3620, PIX515, VPN and Routing.

[pjwhitby]

I have this scenario to fix :


<=> frame relay link => c3640 <===============>
c3620 switch
<=> pix515-a f/w <=> internet <=> pix515-b f/w <===>
<==VPN Tunnel==>

I hope thats clear !

Now my issue is this. The current setup does not have a VPN tunnel, therefore traffic from Site A (left) passes to Site B (right) via the Frame Relay link and internet traffic from Site A goes out via the PIX515-a firewall.

Now what I want to do is create a VPN Tunnel between pix515-a and pix515-b that will act as the primary conduit for data, yes I know this sounds daft, but I want the VPN to carry the traffic between sites with the Frame Relay link acting as a backup conduit.

I can create the VPN tunnel and get traffic to pass, thats not my problem, my problem is getting the Frame Relay circuit to act as the backup circuit. If the PIX could use HSRP then I would be okay, but I am at a loss on this one.

Any suggestions?, my gut feeling is that this just will not work. Any suggestions on how to make it work would also be gratefully accepted.

pjwhitby
cne/ccda/ccnp/mcse

 

[RoundAbout]

I just read at Cisco's site that one of the Cons of using DDR is that &quot;It is dependent upon the interface going down. The router must detect that the primary interface line protocol is down for it to activate the backup link.&quot;

In my case the interface will NOT generally go down when the VPN tunnel is lost.

Perhaps &quot;floating static routes&quot; are a better choice?

RoundAbout

 

[tschouten]

Round about is right, crap why didn't I see that, I'm getting sloppy. Uhhm, would say try using a floating static route.

 

[RoundAbout]

I'm having some limited success with OSPF and distance metrics. Still working out some buggyness.

The problem I'm seeing is that when I assign a metric of 200 to the VPNs route it shows up as [200/0] in the routing table, but when I assign a metric of 220 to the Serial link (backup) it shows up as [110/65] or [110/75]?!?

The VPN route is also (sometimes) showing up as an &quot;S&quot; (Static Route) rather than an &quot;O&quot; for an OSPF route.

I'm confused.

I'm playing with adding cost and bandwidth values directly to the interfaces. THAT'LL TEACH 'EM! Bastards...

RoundAbout