VLAN Stretch Across Site To Site VPN?

[AndyCorbett]

I have my main site and our DR site connected via 2 ASA 5520's over a dedicated site to site VPN tunnel. I would like to have the servers on the DR side be on the same subnet as our main site, is there anyway to stretch that VLAN over this link?

 

[ADB100]

Not possible directly with a firewall unless you start using host routes and proxy-arp. I assume you are looking at VMWare and having the ability to virtualise servers in either location? You could look into L2TPv3 but you would need some IOS routers to achieve this:

http://www.cisco.com/en/US/netsol/n...g_solutions_white_paper09186a008017fa6e.shtml

It will still be a job getting the routing correct though.

There are other ways - DNS springs to mind...

Andy

 

[AndyCorbett]

Yep - VMWare is exactly what we are doing! Tell me more about this DNS that is springing to your mind...

Thanks!

 

[ADB100]

Instead of hard-coding the IP address on the VMWare guest I was thinking of using DHCP along with reservations & Dynamic DNS. This will ensure that if the host materialises at the Main site it will always have the same IP address. If it get's zapped and re-materialises at the DR site it will get a different IP Address but still one that's dictated via DHCP reservations. Dynamic DNS should allow the DNS entry to be updated automatically and you could tune the DNS timers for the zone to ensure reasonably quick failover.
I have tested something similar at home when migrating some MS Virtual Server guest images from one server to another and it does work. I haven't tested it in anger though and with it being a DR solution I would want to test it pretty well...

Andy