VPN failover to frame realy

[Pancevo1956]

I have vpn connection to an overseas location - IPSEC (site-to-site), Cisco 2601, and it woorks OK. in the meantime The overseas company establish location in my state. They are considering how to set up backup link to my company through Frame Relay. In fact they are considering something like failover scheme.


I do not know how to do it? OK I might set up a sort of HSRP to watch whether the overseas router-firewall is alive, and in the case of failure to switch to locition close to me through frame relay connection. I have one spare FR interface on my router.


Is there some reference manual (case study perhaps) to help me?

 

[unclerico]

depending on your architecture at each location it could be a combination of floating static routes with hsrp, ip sla with hsrp, or using a dynamic routing protocol (depending on how you have your L2L VPN setup) with hsrp.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[Pancevo1956]

I have static routes for both IPsec (tunnel) and nonecrypted interface (FR). However could I not figure out whether this could fit into the entry order of operation or not?

"If IPSec, then check input access list
Decryption--for Cisco Encryption Technology (CET) or IPSec
Check input access list
Check input rate limits
Input accounting
Policy routing
Routing
Redirect to Web cache
NAT inside to outside (local to global translation)
Crypto (check map and mark for encryption)
Check output access list
Inspect context-based access control (CBAC)
TCP intercept
Encryption
Here's the order of operations for the outside-to-inside list:

If IPSec, then check input access list
Decryption--for CET or IPSec
Check input access list
Check input rate limits
Input accounting
NAT outside to inside (global to local translation)
Policy routing
Routing
Redirect to Web cache
Crypto (check map and mark for encryption)
Check output access list
Inspect CBAC
TCP intercept
Encryption "

Let say that I use AD for static route 110 for VPN 110 and 120 for nonencrypted (backup). Would it work?

 

[unclerico]

yes, what you're referring to are floating static routes. i would put the AD lower just because 110 and 120 are ADs for OSPF and RIP (it probably won't hurt anything, but i'm picky); something like a static without an AD specified (1) and then a static with an AD specified of like 2 or higher. have hsrp track the tunnel on the routers terminating the L2L VPN and the serial interface on the router with the frame link.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)