Is this possible?

[hunterdw]

Ponder the following situation:

Central location EDM (edmond) - 192.168.1.0/24, 172.16.10.0/24, 172.16.11.0/24, 172.16.20.0/24, 172.16.21.0/24

Remote location STW (stillwater) - 192.168.4.0/24

Remote location TUL (tulsa) - 192.168.3.0/24

Currently, Central is connected to Stillwater with a Cisco 1710 at both ends. IPSec running between. Both of these connections are through Qwest ISP.

Also currently, Central is connected to Tulsa with a Cisco 1710 (same 1710 as above) at Central and 1760 in Tulsa. IPSec running between. Both of these connections are through Qwest ISP.

I want to create some failover / redundancy in our network. Each location also has a Cox ISP location. So, at the central location I have this wonderful little PIX 515e which also does IPSec tunnels.

At each remote location I have an IPCop content filter which goes through the Cox ISP. IPCop can do IPSec.

I want my redundant links to be from the PIX (central) to each IPCop box.

Is this possible? I've been struggling the last week with this stupid setup. As best as I can tell, I can get the tunnels up and running but cannot get any traffic going between them. "themut" has given me wonderful information (thank you) but I can't get it figured out.

I know that the PIX 515e is not a router, but can it act as a router similar to the 1710?

--DW

 

[routerman]

Yes you can, I've implemented a similar backup system for one of my customers.

The way to do this is to use GRE tunnels between the routers, and encrypt the tunnel traffic. Then you run a dynamic routing protocol across the GRE tunnels. Each tunnel forms a point to point circuit that represents the topology you want to implement, with your backup tunnels going out via the PIX.

So EIGRP (in my case) form a neighbour relationship with the remote site across each tunnel circuit. Using the delay metric its an easy task to determine which is the primary and which is the secondary link.

When the primary fails, EIGRP looses its neighbour relationship and the routing protocol converges on the alternate path.

Ok, so why use such a complex sounding setup, its because IPSec wont pass multicasts so EIGRP neighbours dont see each other. And as Internet based failures are hidden from the routers, the routers cannot reconverge on a new path because they may not see the failure.