this will be pretty easy to do. you will run OSPF across all of the PtP circuits so that if the Internet connection on site C or D goes down it will be able to use site A as a transit to reach site B and vice versa. you must configure your firewalls to permit ICMP Echo traffic from the other sites (Site B needs to permit ICMP Echos from Site A, C, and D. Site D needs to permit ICMP Echos from Site B, etc). Since static routes will be preferred over the OSPF routes (assuming that the prefix length is the same) the routing tables will look like this:
Site A
OSPF route to Site C and D over the PtP links
Tracked static route over the VPN to Site B
Site B
Tracked static route over the VPN to all other sites
Site C
OSPF route to Site A over the PtP link
OSPF route to Site D over the PtP link
Tracked static route over the VPN to Site B
Site D
OSPF route to Site A over the PtP link
OSPF route to Site C over the PtP link
Tracked static route over the VPN to Site B
if the connection to the Internet at Site B goes down then the static routes at Site A, C, and D will be removed from the routing table and OSPF will do its thing to route everything through Site A to reach Site B. Site B will then use Site A to reach Site C and Site D. When the connection to the Internet comes back on line at Site B then the static routes will be installed in the other sites routing tables and the OSPF routes will be removed
the only thing this doesn't do is permit Site C and Site D to communicate over the VPN to each other; they will use Site A as a transit.
you may even want to alter this in such a way that your default routes are tracked and will reroute your web traffic over your private circuits (if you have enough capacity that is)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Using the following as an addressing scheme:
Site A subnets: 192.168.1.0/24 (LAN), 172.16.12.0/30 (PtP - B), 172.16.13.0/30 (PtP - C), 172.16.14.0/30 (PtP - D)
Site B subnets: 192.168.2.0/24 (LAN), 172.16.12.0/30 (PtP - A)
Site C subnets: 192.168.3.0/24 (LAN), 172.16.13.0/30 (PtP - A)
Site D subnets: 192.168.4.0/24 (LAN), 172.16.14.0/30 (PtP - A)
Site A core switch:
Code:
ip sla monitor 1
type echo protocol ipicmpecho <outside_ip_site_b_asa>
frequency 5
timeout 5000
ip sla monitor schedule 1 life forever start-time now
track 1 rtr 1 reachability
ip route 0.0.0.0 0.0.0.0 <ASA_inside_ip>
ip route 192.168.2.0 255.255.255.0 <ASA_inside_Ip> track 1
router ospf 1
network 192.168.1.0 0.0.0.255 area 0
network 172.16.12.0 0.0.0.3 area 0
network 172.16.13.0 0.0.0.3 area 0
network 172.16.14.0 0.0.0.3 area 0
SiteB core switch:
Code:
ip sla monitor 1
type echo protocol ipicmpecho <outside_ip_siteA_ASA>
frequency 5
timeout 5000
ip sla monitor 2
type echo protocol ipicmpecho <outside_ip_siteC_ASA>
frequency 5
timeout 5000
ip sla monitor 3
type echo protocol ipicmpecho <outside_ip_siteD_ASA>
frequency 5
timeout 5000
ip sla monitor schedule 1 life forever start-time now
ip sla monitor schedule 2 life forever start-time now
ip sla monitor schedule 3 life forever start-time now
track 1 rtr 1 reachability
track 2 rtr 2 reachability
track 3 rtr 3 reachability
ip route 0.0.0.0 0.0.0.0 <asa_inside_ip>
ip route 192.168.1.0 255.255.255.0 <asa_inside_ip> track 1
ip route 192.168.3.0 255.255.255.0 <asa_inside_ip> track 2
ip route 192.168.4.0 255.255.255.0 <asa_inside_ip> track 3
router ospf 1
network 192.168.2.0 0.0.0.255 area 0
network 172.16.12.0 0.0.0.3 area 0
SiteC core switch:
Code:
ip sla monitor 1
type echo protocol ipicmpecho <outside_ip_site_b_asa>
frequency 5
timeout 5000
ip sla monitor schedule 1 life forever start-time now
track 1 rtr 1 reachability
ip route 0.0.0.0 0.0.0.0 <asa_inside_ip>
ip route 192.168.2.0 255.255.255.0 <asa_inside_ip> track 1
router ospf 1
network 192.168.3.0 0.0.0.255 area 0
network 172.16.13.0 0.0.0.3 area 0
SiteD core switch:
Code:
ip sla monitor 1
type echo protocol ipicmpecho <outside_ip_site_b_asa>
frequency 5
timeout 5000
ip sla monitor schedule 1 life forever start-time now
track 1 rtr 1 reachability
ip route 0.0.0.0 0.0.0.0 <next_hop_ip>
ip route 192.168.2.0 255.255.255.0 <ASA_inside_Ip> track 1
router ospf 1
network 192.168.4.0 0.0.0.255 area 0
network 172.16.14.0 0.0.0.3 area 0
I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)
