Site-to-Site VPN as Primary with PtP as backup in an OSPF environment?

Unanswered Question
Jul 2nd, 2010

I thought I found a solution for this previously, but can't seem to find it again.  If someone knows of a link, please post it.  I'm not sure if IP SLA's would do this.

My company has historically used point-to-point connections for our WAN.  Recently, to reduce costs and increase bandwidth, we installed a 10Mbps Internet link in our Oakland office and want to use it as the primary WAN link.  We have an ASA 5505 in that office and an ASA 5520 in our DC office.  The current PtP T1 WAN link between those offices is still cost effective as a backup, so we would like to use the Site-to-Site VPN between the two ASA's as a Primary link.  But if it goes down, we would like to insert routes to redirect traffic across the PtP T1.

The past 5 years or so we've been using OSPF as our routing protocol.  But to get routing across the VPN to work properly, I had to disable OSPF on the routers in the remote office.  So if the Internet connection drops (whether it's the local connection or the one in the DC office) traffic between the Oakland office and the rest of our offices would stop until the link is fixed.

Is it possible to somehow integrate VPN links in an OSPF environment?  Such that if the VPN cannot be established, different routes are inserted in the routing table to use the T1?

I can supply some basic router/WAN topology diagrams if it would help.

Thanks,

Jim Makowski

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Federico Coto F... Sat, 07/03/2010 - 16:46

Hi,

OSPF will work through IPsec only if the peers are specified manually as only unicast packets can go through IPsec.

Also, I don't see why IP SLAs won't work?

Federico.

amar_5664 Mon, 07/05/2010 - 18:02

hi Jim,

you can run OSPF on top of IPSEC using GRE. if the ipsec is not established i dont have any backup paths but i presume if you have routes in your table with higher metric/AD that link might be used as backup. not sure if it would achieve your purpose.

Actions

This Discussion