What's the topology? One CPE terminating MPLS and IPSEC tunnel? If this is the case, then if at one site MPLS goes down, it starts to use IPSEC tunnel, when packets get to the other side, the default route to MPLS VPN is still there so packets will get routed back into the MPLS cloud. You need more specific routes advertised so that when MPLS lost, it will withdraw the route and IPSEC will kick in. Just a default won't work unless you'll be doing some creative conditional advertising in the BGP or some fancy EEM scripting...or maybe using ip sla to withdraw route...which might be a little more complicated than need be.
Even with specific routes, you still have lots of decision to make like whether to switch everything to use IPSEC tunnels once just ONE MPLS connection goes down or only that site. Then you have to make sure not running into asymmetric routing...etc. With GNS3/Dynagen, you could probably test this whole thing out in your labtop. --------------------------------------- Luan Nguyen Chesapeake NetCraftsmen, LLC. [Web] http://www.netcraftsmen.net --------------------------------------- -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Jason LeBlanc Sent: Tuesday, January 26, 2010 4:20 PM To: Cisco-nsp Subject: [c-nsp] MPLS VPN Running BGP w/ failover IPSec VPN Over Internet Team, This questions was put out there before in another chain but I wasn't able to figure out the best solution. We have multiple campuses connecting to an MPLS VPN cloud running BGP internally. At some locations we have backup ISP services and an IPSec VPN tunnel over that. Currently BGP provides a default route to each campus as external BGP / Pref 40 / Metric 0. Our backup IPSec is in as a Static / Pref 20 / Metric 32000. When we lose BGP/MPLS VPN we want the IPSec tunnel to begin routing traffic between the campus and our main datacenter. What is the best way to achieve this? Thanks, //LeBlanc _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ __________ Information from ESET NOD32 Antivirus, version of virus signature database 4807 (20100126) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
