I have a mobile application that utilizes cellular and satcom services to form a VPN connection to our hub. In the current configuration, failover works based on the
ip hello-interval eigrp 1 15,
ip hold-time eigrp 1 60 within the tunnels. The problem is that as we move between to an area where cellular coverage is poor or non-existent, it takes 60-100 seconds for data to flow across our secondary ISP. As we transition back within cellular caoverage, the same latency is observed. I expect this because of our EIGRP timers. We often bounce between the services many times during the day.
Is there a better method to implement failover with limited interuption of service? I've seen the use of IP SLA and applets, but I am having trouble adopting it to this configuration.
The individual who created this configuration has since left the company and I am looking for any help you can provide. I am open to almost any configuration change required to get this operational and any suggestions that you may have in improving the configuration.
Configuration snippets below (IP addresses, passwords, and crypto changed for security).
hostname Spoke 1 ! vlan 2 name VLAN ! boot-start-marker boot-end-marker ntp server 188.8.131.52 ! ! vrf definition CELL rd 100:1 ! address-family ipv4 exit-address-family ! vrf definition SAT rd 100:2 ! address-family ipv4 exit-address-family
crypto keyring KEY-CELL vrf CELL pre-shared-key address 192.168.2.1 key cisco crypto keyring KEY-SAT vrf SAT pre-shared-key address 192.168.2.1 key cisco ! crypto isakmp policy 5 encr aes 256 authentication pre-share group 5 crypto isakmp keepalive 30 crypto isakmp nat keepalive 30 ! crypto isakmp key cisco address 0.0.0.0 crypto isakmp profile PROF-SAT vrf SAT keyring KEY-SAT match identity address 192.168.2.1 255.255.255.255 crypto isakmp profile PROF-CELL vrf CELL keyring KEY-CELL match identity address 192.168.2.1 255.255.255.255 ! crypto ipsec transform-set ESP-AES256-TRANSPORT-SET esp-aes 256 esp-sha-hmac mode transport ! crypto ipsec profile IPSEC-PROFILE set security-association lifetime seconds 86400 set transform-set ESP-AES256-TRANSPORT-SET set pfs group5 set isakmp-profile PROF-CELL ! crypto ipsec profile IPSEC-SATCOM-PROFILE set security-association lifetime seconds 86400 set transform-set ESP-AES256-TRANSPORT-SET set pfs group5 set isakmp-profile PROF-SAT !
interface Loopback1 ip address 184.108.40.206 255.255.255.255 ip pim sparse-mode ! interface Tunnel1 description DMVPN Profile 1 ip address 10.202.1.1 255.255.255.0 no ip redirects ip mtu 1400 ip hello-interval eigrp 1 15 no ip split-horizon eigrp 1 ip hold-time eigrp 1 60 ip pim dr-priority 0 ip pim nbma-mode ip pim sparse-mode ip nat outside ip nhrp authentication 123456 ip nhrp map multicast 192.168.2.1 ip nhrp map 10.202.1.254 192.168.2.1 ip nhrp network-id 123456 ip nhrp holdtime 300 ip nhrp nhs 10.202.1.254 ip virtual-reassembly in ip tcp adjust-mss 1360 qos pre-classify tunnel source FastEthernet0/0 tunnel mode gre multipoint tunnel key 123456 tunnel vrf CELL tunnel protection ipsec profile IPSEC-PROFILE ! interface Tunnel2 description DMVPN Profile 2 bandwidth 56 ip address 10.202.2.1 255.255.255.0 no ip redirects ip mtu 1400 ip hello-interval eigrp 1 15 ip hold-time eigrp 1 60 no ip split-horizon eigrp 1 ip pim dr-priority 2 ip pim nbma-mode ip pim sparse-mode ip nat outside ip nhrp authentication 789123 ip nhrp map multicast 192.168.2.1 ip nhrp map 10.202.2.254 192.168.2.1 ip nhrp network-id 789123 ip nhrp holdtime 300 ip nhrp nhs 10.202.2.254 ip virtual-reassembly in ip tcp adjust-mss 1350 load-interval 30 delay 20100 qos pre-classify tunnel source FastEthernet0/1 tunnel mode gre multipoint tunnel key 789123 tunnel vrf SAT tunnel protection ipsec profile IPSEC-SATCOM-PROFILE ! interface FastEthernet0/0 description CradlePoint vrf forwarding CELL ip address dhcp ip virtual-reassembly in duplex full speed 100 no shutdown ! interface FastEthernet0/1 description SATCOM BACKUP vrf forwarding SAT ip address dhcp ip virtual-reassembly in duplex full speed 100 no shutdown ! interface range fa0/2 - 4 switchport mode access switchport access vlan 2 no shut ! ! interface Vlan2 description Vlan2 ip address 220.127.116.11 255.255.192.0 secondary ip address 18.104.22.168 255.255.255.252 ip pim state-refresh origination-interval 60 ip pim sparse-mode ip nat inside ip virtual-reassembly in ip igmp query-max-response-time 1 ip igmp version 3 ip igmp query-interval 2 !
ip forward-protocol nd no ip http server no ip http secure-server ! router eigrp 1 network 10.0.0.0 redistribute connected route-map redist-connected redistribute static route-map redist-static passive-interface default no passive-interface Tunnel1 no passive-interface Tunnel2 ! ip pim rp-address 10.50.254.254 ip pim spt-threshold infinity ip pim register-source tunnel1 ip nat pool MCAST-NAT-POOL 22.214.171.124 126.96.36.199 netmask 188.8.131.52 ip nat inside source route-map INTERNET-PNAT-MAP interface FastEthernet0/0 overload ip nat inside source route-map MCAST-NAT-MAP pool MCAST-NAT-POOL ip route 184.108.40.206 255.255.255.0 Null0 ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 dhcp ! ip access-list standard redist-connected permit 220.127.116.11 0.0.63.255 permit 192.168.0.0 0.0.255.255 ! ip access-list standard redist-static permit 18.104.22.168 0.0.0.255 ! ip access-list extended INTERNET-PNAT-LIST deny ip any 10.0.0.0 0.255.255.255 deny ip any 22.214.171.124 0.31.255.255 deny ip any 192.168.0.0 0.0.255.255 deny ip any 126.96.36.199 188.8.131.52 permit ip 184.108.40.206 0.0.255.255 any ! ip access-list extended MCAST-NAT-LIST permit ip 220.127.116.11 0.0.63.255 18.104.22.168 22.214.171.124 route-map redist-static permit 10 match ip address redist-static ! route-map MCAST-NAT-MAP permit 10 match ip address MCAST-NAT-LIST ! route-map INTERNET-PNAT-MAP permit 10 match ip address INTERNET-PNAT-LIST ! route-map redist-connected permit 10 match ip address redist-connected !