1

I have a mobile application that utilizes cellular and satcom services to form a VPN connection to our hub. In the current configuration, failover works based on the ip hello-interval eigrp 1 15, ip hold-time eigrp 1 60 within the tunnels. The problem is that as we move between to an area where cellular coverage is poor or non-existent, it takes 60-100 seconds for data to flow across our secondary ISP. As we transition back within cellular caoverage, the same latency is observed. I expect this because of our EIGRP timers. We often bounce between the services many times during the day.

Is there a better method to implement failover with limited interuption of service? I've seen the use of IP SLA and applets, but I am having trouble adopting it to this configuration.

The individual who created this configuration has since left the company and I am looking for any help you can provide. I am open to almost any configuration change required to get this operational and any suggestions that you may have in improving the configuration.

Configuration snippets below (IP addresses, passwords, and crypto changed for security).

hostname Spoke 1
!
vlan 2
 name VLAN
!
boot-start-marker
boot-end-marker
ntp server 172.1.1.2
!
!
vrf definition CELL
 rd 100:1
 !
 address-family ipv4
 exit-address-family
!
vrf definition SAT
 rd 100:2
 !
 address-family ipv4
 exit-address-family

Crypto Section

crypto keyring KEY-CELL vrf CELL
 pre-shared-key address 192.168.2.1 key cisco
crypto keyring KEY-SAT vrf SAT
 pre-shared-key address 192.168.2.1 key cisco
!
crypto isakmp policy 5
 encr aes 256
 authentication pre-share
 group 5
crypto isakmp keepalive 30
crypto isakmp nat keepalive 30
!
crypto isakmp key cisco address 0.0.0.0
crypto isakmp profile PROF-SAT
 vrf SAT
 keyring KEY-SAT
 match identity address 192.168.2.1 255.255.255.255
crypto isakmp profile PROF-CELL
 vrf CELL
 keyring KEY-CELL
 match identity address 192.168.2.1 255.255.255.255
!
crypto ipsec transform-set ESP-AES256-TRANSPORT-SET esp-aes 256 esp-sha-hmac 
 mode transport
!
crypto ipsec profile IPSEC-PROFILE
 set security-association lifetime seconds 86400
 set transform-set ESP-AES256-TRANSPORT-SET
 set pfs group5
 set isakmp-profile PROF-CELL
!
crypto ipsec profile IPSEC-SATCOM-PROFILE
 set security-association lifetime seconds 86400
 set transform-set ESP-AES256-TRANSPORT-SET 
 set pfs group5
 set isakmp-profile PROF-SAT
!

Interfaces

interface Loopback1
 ip address 172.1.1.255 255.255.255.255
 ip pim sparse-mode
!
interface Tunnel1
 description DMVPN Profile 1
 ip address 10.202.1.1 255.255.255.0
 no ip redirects
 ip mtu 1400
 ip hello-interval eigrp 1 15
 no ip split-horizon eigrp 1
 ip hold-time eigrp 1 60
 ip pim dr-priority 0
 ip pim nbma-mode
 ip pim sparse-mode
 ip nat outside
 ip nhrp authentication 123456
 ip nhrp map multicast 192.168.2.1
 ip nhrp map 10.202.1.254 192.168.2.1
 ip nhrp network-id 123456
 ip nhrp holdtime 300
 ip nhrp nhs 10.202.1.254
 ip virtual-reassembly in
 ip tcp adjust-mss 1360
 qos pre-classify
 tunnel source FastEthernet0/0
 tunnel mode gre multipoint
 tunnel key 123456
 tunnel vrf CELL
 tunnel protection ipsec profile IPSEC-PROFILE
!
interface Tunnel2
 description DMVPN Profile 2
 bandwidth 56
 ip address 10.202.2.1 255.255.255.0
 no ip redirects
 ip mtu 1400
 ip hello-interval eigrp 1 15
 ip hold-time eigrp 1 60
 no ip split-horizon eigrp 1
 ip pim dr-priority 2
 ip pim nbma-mode
 ip pim sparse-mode
 ip nat outside
 ip nhrp authentication 789123
 ip nhrp map multicast 192.168.2.1
 ip nhrp map 10.202.2.254 192.168.2.1
 ip nhrp network-id 789123
 ip nhrp holdtime 300
 ip nhrp nhs 10.202.2.254
 ip virtual-reassembly in
 ip tcp adjust-mss 1350
 load-interval 30
 delay 20100
 qos pre-classify
 tunnel source FastEthernet0/1
 tunnel mode gre multipoint
 tunnel key 789123
 tunnel vrf SAT
 tunnel protection ipsec profile IPSEC-SATCOM-PROFILE
!
interface FastEthernet0/0
 description CradlePoint
 vrf forwarding CELL
 ip address dhcp
 ip virtual-reassembly in
 duplex full
 speed 100
no shutdown
!
interface FastEthernet0/1
 description SATCOM BACKUP
 vrf forwarding SAT
 ip address dhcp
 ip virtual-reassembly in
 duplex full
 speed 100
no shutdown
!
interface range fa0/2 - 4
 switchport mode access
 switchport access vlan 2
 no shut
!
!
interface Vlan2
 description Vlan2
 ip address 172.2.63.254 255.255.192.0 secondary
 ip address 172.1.1.1 255.255.255.252
 ip pim state-refresh origination-interval 60
 ip pim sparse-mode
 ip nat inside
 ip virtual-reassembly in
 ip igmp query-max-response-time 1
 ip igmp version 3
 ip igmp query-interval 2
!

Routing

ip forward-protocol nd
no ip http server
no ip http secure-server
!
router eigrp 1
 network 10.0.0.0
 redistribute connected route-map redist-connected
 redistribute static route-map redist-static
 passive-interface default
 no passive-interface Tunnel1
 no passive-interface Tunnel2
!
ip pim rp-address 10.50.254.254
ip pim spt-threshold infinity
ip pim register-source tunnel1
ip nat pool MCAST-NAT-POOL 172.1.1.5 172.1.1.250 netmask 55.255.255.0
ip nat inside source route-map INTERNET-PNAT-MAP interface FastEthernet0/0 overload
ip nat inside source route-map MCAST-NAT-MAP pool MCAST-NAT-POOL
ip route 172.1.1.0 255.255.255.0 Null0
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 dhcp
!
ip access-list standard redist-connected
permit 172.2.0.0 0.0.63.255
permit 192.168.0.0 0.0.255.255
!
ip access-list standard redist-static
 permit 172.1.1.0 0.0.0.255
!
ip access-list extended INTERNET-PNAT-LIST
 deny ip any 10.0.0.0 0.255.255.255
 deny ip any 172.0.0.0 0.31.255.255
 deny ip any 192.168.0.0 0.0.255.255
 deny ip any 224.0.0.0 15.255.255.255
 permit ip 172.2.0.0 0.0.255.255 any
!
ip access-list extended MCAST-NAT-LIST
 permit ip 172.2.0.0 0.0.63.255 224.0.0.0 15.255.255.255
route-map redist-static permit 10
match ip address redist-static
!
route-map MCAST-NAT-MAP permit 10
 match ip address MCAST-NAT-LIST
!
route-map INTERNET-PNAT-MAP permit 10
 match ip address INTERNET-PNAT-LIST
!
route-map redist-connected permit 10
 match ip address redist-connected
!
1
  • I fixed your formatting. Please do not use HTML codes for formatting. SE has markdown for formatting, and it is simpler and works better. – Ron Maupin Aug 16 '17 at 18:07
1

Tuning requires a bit of trial and error since all situations are unique. I would suggest the following as a starting point:

  1. Check your feasible successors. The big advantage with EIGRP is the use of feasible successors which is basically a backup route that EIGRP knows is loop-free and it can start using immediately if the primary route is lost. Since you are using default metrics, you need to tune the bandwidth and delay settings of your interfaces to make sure there is a feasible successor available. You can check for them in show ip eigrp topology

Cisco EIGRP

  1. Look into enabling BFD. BFD is a separate protocol that EIGRP can subscribe to for failure detection. It can provide sub-second failure detection in a LAN environment, but you don't want that over a lossy WAN connection like the internet. You'll tune the timers higher for the WAN, but the advantage with BFD is you can configure BFD dampening. When you are on the border of a cell/sat connection you can get a lot of flapping back and forth when using low timers, if you configure dampening it will detect the flapping and stop the convergence for a time period to stabilize the connection.

BFD Overview

BFD for EIGRP

BFD Dampening

You'll want to get some spare gear and test this out and tune it before configuring on all your production gear.

1
  • Thank you John. I had looked at BFD a while back but I was unable to assign BFD to a tunnel interface. I have since downloaded the updated IOS and the feature is now available. I will test in a controlled environment to isolate the correct parameters for my use. I appreciate your time and helpful links. – Matthew Aug 17 '17 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.