Exactly. This is a secondary form of calling back home if the MPLS Link or BGP
breaks. We have static routes at the remote site pointing traffic over the
IPSEC tunnel if it fails. If MPLS is lost we want the remote campus to be able
to communicate with the main datacenter which is also where the main MPLS
router exists. We currently have a VPN devices at the Datacenter that runs
OSPF on the home end.
MPLS Router 7200-----------------------> {AT&T MPLS Cloud} -->
/
\
Core 6500 --> Distribution Router 6500 --
-- Campus Router Cisco or Juniper SSG
\
/
Site to site VPN Juniper ISG-1000 --> {ISP IPSEC VPN}-------->
On Jan 27, 2010, at 11:22 AM, Ivan Pepelnjak wrote:
> Jason, are you trying to solve only the remote site problem? Is the main
> campus receiving specific routes for each remote site through the MPLS VPN
> cloud?
>
>> -----Original Message-----
>> From: Jason LeBlanc [mailto:[email protected]]
>> Sent: Wednesday, January 27, 2010 1:48 AM
>> To: Luan Nguyen
>> Cc: 'Cisco-nsp'
>> Subject: Re: [c-nsp] MPLS VPN Running BGP w/ failover IPSec VPN Over
>> Internet
>>
>> Current topology is pretty simple. AT&T drops an MPLS circuit either PPP
>> Multilink Bundled T1's or an Ethernet hand off. On another interface we
>> generally have an ethernet hand off from another ISP. We run BGP to move
>> all the traffic around on one 172.x.x.x/30's and then our LAN is on
>> 10.x.x.x. We have an outside IP address on another ethernet port which is
>> the IPSEC termination point. BGP from our main campus injects a default
>> route which we receive. Currently we just manually added static 0.0.0.0
>> routes out the tunnel interfaces with a metric of 32000. So when BGP
>> drops off we will route over the IPSEC VPN Tunnel back home.
>>
>> Headquarters 172.1.1.1/30 --> ATTMPLS 172.1.1.2/30 -->
>>
>> ATTMPLS 172.2.2.1/30 --> Remote Campus 172.2.2.2/30 (running BGP) -->
>> 10.1.1.1/24
>>
>> ISP-X Ethernet 200.1.1.1/30 --> Remote Campus 200.1.1.2/30 --> IPSEC VPN
>> Tunnel.1 10.1.1.20/24 --> Headquarters Tunnel.1 10.1.1.21/24
>>
>> BGP Provides default route
>> Static 0.0.0.0 0.0.0.0 Tunel.1 Metric 32000
>>
>> It is my assumption that if the traffic cant get to its destination
>> because BGP has lost it our backup link the IPSEC VPN with the higher
>> metric will become the new default route.
>
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
