Routing through VPN

[kunz12]

Guys -

I am in the process of configuring a site-2-site VPN connection over DSL lines that we have installed at each branch office. The purpose of the VPN connection is to act as a backup when the main connection from the branch to the headquarters goes down. All branch offices and headquarters are connected thru MPLS. So the DSL lines have been installed only as a backup.

The VPN connection between the branch and HQ is terminating on a Cisco 3845 router at HQ. The 3845 sits behind the firewall. This 3845 also connects the HQ to the MPLS. I will call this 3845_A for reference purposes. In addition, there is another 3845 at HQ that is used in conjunction with 3845_A for load balancing over the MPLS. I will call this 3845_B.

Both A & B routers are connected to the same Cisco 3750 stack. The 3750 is running OSPF and can route traffic from HQ to branch offices either through A or B router. However, when a branch office goes down, the routes are removed from the 3750 and the VPN tunnel is initiated from the branch over the backup DSL.

All the servers at HQ are also connected to the 3750 stack (in a different vlan). So when a user at a branch office is trying to connect to a server at HQ, at that point the 3750 does not have a route back to the branch office. I can write static routes on the 3750 pointing all traffic for the branch office through the firewall, but those static routes will have to be removed each time the connection to the branch office is restored.

Sorry for the long post but I was wondering what's the best way to configure routing in this situation.

Thanks for your help!!

 

[burtsbees]

Those static routes will not have to be removed---just make them floaters by making the metrics slightly higher than 110 (I think that's what OSPF is). That way, the router will choose the lower OSPF metric, unless the OSPF route goes down.
When the OSPF comes back up, the router will choose to route via the lower OSPF metric again.

Burt

 

[KwikNet]

You can also set up GRE tunnels over the IPSEC tunnels and that will allow you to pass routing protocol information over the ipsec tunnel. Example provided is using OSPF.

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00800a43f6.shtml

But the floating statics would work as well. Just depends on size of network I guess when configuring statics.