DMVPN High Available

cassio.gomes · ‎06-28-2007

Dear All,

I have a DMVPN scenario, and it works very fine. Now I would like to put a new Hub router, as backup, and between HUB1 and HUB2, I have configured HSRP and the spokes routers connect in the Virtual IP Address.

After this configuration, the vpn goes down.

So I need help to solve this issue in this scenario, DMVPN with primary and secondary HUB.

Best Regards,

CLRGomes

Report Inappropriate Content · ‎07-04-2007

When using pure IPsec with two hubs where you need redundancy, you have to combine this with a mechanism like HSRP. This is because we cannot run a dynamic routing protocol through the pure IPsec tunnels to help out with forwarding traffic. So the Stateful IPsec feature was added to specifically have IPsec work with HSRP and keep the IPsec and ISAKMP SA databases synchronized between the two HSRP routers. Therefore HSRP can switch the encrypted traffic between the two HSRP routers as necessary without too much loss of traffic. REfer URL

http://www.cisco.com/en/US/partner/tech/tk583/tk372/technologies_white_paper09186a008018983e.shtml#dualhubs

ovt · ‎07-08-2007

Don't go this way (stateful IPSec / HSRP). Read DMVPN SRND -- it has examples on how to configure dual-Hub DMVPN networks).