Cisco Support Community
Community Member

Redundant ipsec/GRE

Hi all

I have a 10x857 connecting to 2821 with IPSEC.

I also have an 1801 for general internet connection and would like to provide redundant VPN to it from the 857?s.

The best solution I believe is DMVPN but the 857 doesn't support it.

Any ideas for alternative configuration to provide VPN redundancy for the 857?s?



Re: Redundant ipsec/GRE

You can look at DPD + RRI or DPD + HSRP between the 2800 and 1800 at the hub for redundancy.This will give u VPN redundancy.

Community Member

Re: Redundant ipsec/GRE

I haven't used an 1801 or 857's, but if they support GRE/IPSec tunnels you can do that. On the brach routers, terminate a GRE/IPSec tunnel to both routers at head office. That allows you to run a routing protocol between them.

I run OSPF across all my VPN tunnels. Primary VPN routers goes down, then the other link converges via OSPF pretty quickly.

I have some config if it would help.

Re: Redundant ipsec/GRE

Hi Nikolay,

I agree with Mark Anthony, as the best way to achieve redundancy at the Head End is to change from IPSec Direct Encapuslation (as I assume you are using) to Peer-to-Peer GRE in IPSec Tunnels which makes the Routing Protocol deployment easy over VPNs.

Then make sure that your branch offices have 2 simultaneous connections to the Head End i.e. 1801 and 2821 (both should have VPN Accelerator cards).

Then run the EIGRP (You could use OSPF as well) and thats it!!!

You have achieved automatic failover mechanism for the IPSec VPNs.


Wilso Samuel

Community Member

Re: Redundant ipsec/GRE

If you don't want to use a dynamic routing protocol to switch between the VPN Connections, it is also possible by using floating static routes; since you have two GRE tunnels (one to the 2800 and one to the 1800) up, it is possible to create two static routes (one with cost 100 and one with cost 150).

I had to use this solution once where I had to enable fallback via ISDN and OSPF kept the ISDN line up because of keepalive packets (and all branch offices learns about the complete network topology which is in some occasions not desirable).


Pieter-Jan Nefkens

作成コンテンツを作成するには してください