How Do You Establish a Backup VPN Tunnel between Two Routers?
I have 2 routers on the Internet. An IPSec virtual private network (VPN) tunnel has been established between them using ip route statements, not routing protocols. One of the routers has two interfaces to the Internet; one is for backup. What is the simplest way to establish a a second VPN tunnel if the first link should go down?
Re: How Do You Establish a Backup VPN Tunnel between Two Routers
The best thing to do is to let routing handle the failover, using the following steps:
Build a normal backup interface configuration.
Then build a generic routing encapsulation (GRE) tunnel and source it from the local router to the remote router using loopbacks.
Change the crypto map to encrypt the GRE peers rather than the IP networks. If you do it this way, the loopbacks are always up, and therefore so is the GRE tunnel. If the GRE tunnel is up, the traffic is encrypted.
Using GRE removes the issue of stale security associations (SAs) existing and preventing the IPSec tunnel from re-forming after an interface hit.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...