I'm not sure, why the need for TWO separate processes? If you have control over your infrastructure, one should be enough.

Anyway, I think we need to know more exactly, how the router is connected, what is on the other side of the leased lines, what on the othewr side of the VPN tunnels, how the tunnles gets to the router etc.

You can use one or many. All depends on the requirements and what routing protocols are used. Why do you think its called "dynamic" routing? :o)

hi,

thanks for the reply, i have drawn a diagram showing the basic connectivity between sites and links. maybe after viewing it things will be able to imagine how to get this failover work.. hoping for a positive reply.

design looks decent, though this takes careful planning. Remember, if you fail to plan, you plan to fail! I highly recommend getting with your network design engineer in regards.

I gave you one of many possibilities of doing failover, but I cannot continue any further as I dont know your organization needs.

Good luck!

hi thanks for the reply,

surly i will carefully plan it before implementing it. just another advise, i am looking into other possibilities e.g. rtr in router IOS, like configure it on the router which connects both the FW.

what's your opinion on it?

Hello,

nice slide. Build GRE tunnels full meshing one router per site. I suggest the one inside the firewall. The GRE tunnel can be point-to-point, or multipoint; I suggest you use point-to-point for simplicity as you have few sites. If you need your data to be encrypted, make IPSec VPN to carry GRE; there is documentation on CCO on how do this.

Then use a routing protocol, you may have one already running to carry reachability information for the LAN of your interest, both on the tunnel interfaces, and the physical WAN. It should not be necessary adjust metrics as by the default the tunnel interfaces has less.

This will provide failover for LAN-to-LAN connectivity on loss of WAN links.