I have a mobile application that utilizes cellular and satcom services to form a VPN connection to our hub. In the current configuration, failover works based on the ip hello-interval eigrp 1 15, ip hold-time eigrp 1 60 within the tunnels. The problem is that as we move between to an area where cellular coverage is poor or non-existent, it takes 60-100 seconds for data to flow across our secondary ISP. As we transition back within cellular caoverage, the same latency is observed. I expect this because of our EIGRP timers. We often bounce between the services many times during the day.
Is there a better method to implement failover with limited interuption of service? I've seen the use of IP SLA and applets, but I am having trouble adopting it to this configuration.
The individual who created this configuration has since left the company and I am looking for any help you can provide. I am open to almost any configuration change required to get this operational and any suggestions that you may have in improving the configuration.
Configuration snippets below (IP addresses, passwords, and crypto changed for security).
hostname Spoke 1
!
vlan 2
name VLAN
!
boot-start-marker
boot-end-marker
ntp server 172.1.1.2
!
!
vrf definition CELL
rd 100:1
!
address-family ipv4
exit-address-family
!
vrf definition SAT
rd 100:2
!
address-family ipv4
exit-address-family
Crypto Section
crypto keyring KEY-CELL vrf CELL
pre-shared-key address 192.168.2.1 key cisco
crypto keyring KEY-SAT vrf SAT
pre-shared-key address 192.168.2.1 key cisco
!
crypto isakmp policy 5
encr aes 256
authentication pre-share
group 5
crypto isakmp keepalive 30
crypto isakmp nat keepalive 30
!
crypto isakmp key cisco address 0.0.0.0
crypto isakmp profile PROF-SAT
vrf SAT
keyring KEY-SAT
match identity address 192.168.2.1 255.255.255.255
crypto isakmp profile PROF-CELL
vrf CELL
keyring KEY-CELL
match identity address 192.168.2.1 255.255.255.255
!
crypto ipsec transform-set ESP-AES256-TRANSPORT-SET esp-aes 256 esp-sha-hmac
mode transport
!
crypto ipsec profile IPSEC-PROFILE
set security-association lifetime seconds 86400
set transform-set ESP-AES256-TRANSPORT-SET
set pfs group5
set isakmp-profile PROF-CELL
!
crypto ipsec profile IPSEC-SATCOM-PROFILE
set security-association lifetime seconds 86400
set transform-set ESP-AES256-TRANSPORT-SET
set pfs group5
set isakmp-profile PROF-SAT
!
Interfaces
interface Loopback1
ip address 172.1.1.255 255.255.255.255
ip pim sparse-mode
!
interface Tunnel1
description DMVPN Profile 1
ip address 10.202.1.1 255.255.255.0
no ip redirects
ip mtu 1400
ip hello-interval eigrp 1 15
no ip split-horizon eigrp 1
ip hold-time eigrp 1 60
ip pim dr-priority 0
ip pim nbma-mode
ip pim sparse-mode
ip nat outside
ip nhrp authentication 123456
ip nhrp map multicast 192.168.2.1
ip nhrp map 10.202.1.254 192.168.2.1
ip nhrp network-id 123456
ip nhrp holdtime 300
ip nhrp nhs 10.202.1.254
ip virtual-reassembly in
ip tcp adjust-mss 1360
qos pre-classify
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 123456
tunnel vrf CELL
tunnel protection ipsec profile IPSEC-PROFILE
!
interface Tunnel2
description DMVPN Profile 2
bandwidth 56
ip address 10.202.2.1 255.255.255.0
no ip redirects
ip mtu 1400
ip hello-interval eigrp 1 15
ip hold-time eigrp 1 60
no ip split-horizon eigrp 1
ip pim dr-priority 2
ip pim nbma-mode
ip pim sparse-mode
ip nat outside
ip nhrp authentication 789123
ip nhrp map multicast 192.168.2.1
ip nhrp map 10.202.2.254 192.168.2.1
ip nhrp network-id 789123
ip nhrp holdtime 300
ip nhrp nhs 10.202.2.254
ip virtual-reassembly in
ip tcp adjust-mss 1350
load-interval 30
delay 20100
qos pre-classify
tunnel source FastEthernet0/1
tunnel mode gre multipoint
tunnel key 789123
tunnel vrf SAT
tunnel protection ipsec profile IPSEC-SATCOM-PROFILE
!
interface FastEthernet0/0
description CradlePoint
vrf forwarding CELL
ip address dhcp
ip virtual-reassembly in
duplex full
speed 100
no shutdown
!
interface FastEthernet0/1
description SATCOM BACKUP
vrf forwarding SAT
ip address dhcp
ip virtual-reassembly in
duplex full
speed 100
no shutdown
!
interface range fa0/2 - 4
switchport mode access
switchport access vlan 2
no shut
!
!
interface Vlan2
description Vlan2
ip address 172.2.63.254 255.255.192.0 secondary
ip address 172.1.1.1 255.255.255.252
ip pim state-refresh origination-interval 60
ip pim sparse-mode
ip nat inside
ip virtual-reassembly in
ip igmp query-max-response-time 1
ip igmp version 3
ip igmp query-interval 2
!
Routing
ip forward-protocol nd
no ip http server
no ip http secure-server
!
router eigrp 1
network 10.0.0.0
redistribute connected route-map redist-connected
redistribute static route-map redist-static
passive-interface default
no passive-interface Tunnel1
no passive-interface Tunnel2
!
ip pim rp-address 10.50.254.254
ip pim spt-threshold infinity
ip pim register-source tunnel1
ip nat pool MCAST-NAT-POOL 172.1.1.5 172.1.1.250 netmask 55.255.255.0
ip nat inside source route-map INTERNET-PNAT-MAP interface FastEthernet0/0 overload
ip nat inside source route-map MCAST-NAT-MAP pool MCAST-NAT-POOL
ip route 172.1.1.0 255.255.255.0 Null0
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 dhcp
!
ip access-list standard redist-connected
permit 172.2.0.0 0.0.63.255
permit 192.168.0.0 0.0.255.255
!
ip access-list standard redist-static
permit 172.1.1.0 0.0.0.255
!
ip access-list extended INTERNET-PNAT-LIST
deny ip any 10.0.0.0 0.255.255.255
deny ip any 172.0.0.0 0.31.255.255
deny ip any 192.168.0.0 0.0.255.255
deny ip any 224.0.0.0 15.255.255.255
permit ip 172.2.0.0 0.0.255.255 any
!
ip access-list extended MCAST-NAT-LIST
permit ip 172.2.0.0 0.0.63.255 224.0.0.0 15.255.255.255
route-map redist-static permit 10
match ip address redist-static
!
route-map MCAST-NAT-MAP permit 10
match ip address MCAST-NAT-LIST
!
route-map INTERNET-PNAT-MAP permit 10
match ip address INTERNET-PNAT-LIST
!
route-map redist-connected permit 10
match ip address redist-connected
!
