FlexVPN using eBGP

[fwiest]

I am trying to configure FlexVPN using eBGP. The only way I can get it to work is to use the remote AS of one of the spokes. Is there a workaround for this? Or do I need to remove the address pool and number each tunnel myself?

router bgp 65511

bgp listen range 10.99.0.0/21 peer-group SPOKES

neighbor SPOKES peer-group

neighbor SPOKES remote-as 65432

neighbor SPOKES update-source Loopback100

neighbor SPOKES next-hop-self all

neighbor SPOKES timers 5 15

neighbor SPOKES soft-reconfiguration inbound

[Graham Bartlett]

Hi

I might be missing the question, so sorry to answer with a question.

Are all spokes going to be in the same AS?

I believe that your config will allow everything in 10.99.0.0/21 to peer with AS 65432, but if you need a different AS then you could change the list range.

If i've missed the point, please feel free to PM me.

cheers

[fwiest]

Hello, and thank you for the response. Each spoke is in a different AS. But in the mean time I found the "local-as" and "remote-as" will solve the problem. So at this point, I have one last problem to solve, routing. Do you have any experience with BGP in FlexVPN?

[Graham Bartlett]

Hi
 

What's the routing issue that you have?

cheers

[fwiest]

We have a MPLS network with a Internet tunnel network for backup. There are times we want to force some traffic over the tunnels instead of MPLS. So I want to force a route between two spokes.

[Graham Bartlett]

Hi

So if i read you correctly - you want this spoke-spoke tunnel to only come up at certain times?

You have the options of

1. run NHRP - so basically implement DMVPN style for the 'interesting' traffic. (i'm not sure if this is what you need as you can't base this on time)

2. use flexvpn client feature, tie this to an SLA or similar using the connect track command.

check this for more info on the tracking feature;

http://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/15-2mt/sec-cfg-flex-clnt.html#GUID-8713BA04-FF96-4F22-9937-CF667485CBEA