1

Okay so I was contracted to provide to design a new WAN topology for quite a large company in my country and designed them a fairly standard IPSec over DMVPN type design.

WAN

So you can see the above topology. Now, my plan is to use OSPF as the routing protocol of choice as they are using that already on other parts of the network, it will all be one area 0. However they also want HSRP to be available on the HUB + SITE1, so that's another consideration. And they also want it to use PKI...so the HUB has to be configured as a dual hub DMVPN IOS CA server with some variant of HSRP....I just want to check that that design makes sense, given it will be a pair of ASR1001-X's (If that changes anything). Just looking for a bit of advice and to check my design is solid! Thanks!

Improve this question
4
  • 1
    I'm confused about the HSRP. That is something to fool hosts on a LAN. If you are connecting sites with routers, you use a routing protocols, and that will fail over much, much faster than HSRP, which is not meant to provide redundancy for router, but for hosts on a LAN.
    – Ron Maupin ♦
    Aug 18, 2017 at 21:25
  • Yes, sorry the HSRP will be on the LAN side of both HUB and SITE1. The LAN1 + LAN2 switches shown represent a large array of access/distribution switches etc.
    – Kevin Robertson
    Aug 19, 2017 at 0:03
  • You probably want to run HSRP on the distribution switches, and run a routing protocol between the distribution switches and the routers. Let the distribution switches handle the LAN routing and the routers handle the site-to-site connections
    – Ron Maupin ♦
    Aug 19, 2017 at 0:08
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Feb 19, 2018 at 17:51

1 Answer 1

Reset to default
2

The design seems pretty straightforward to me, with one apparent oddity I'd like to know more about:

Is there a particular reason not to hook up SITE5 to the WAN directly, but across Site 1 ?

Assuming that the "WAN Switches" are CE devices (in extenso: something like an "extranet switch") of your customer's, and are not the carrier's CPEs, why not hook up SITE5 directly to the "WAN Switch", and have it run it's own set of DMVPN Tunnels? With the situation as shown in the diagram, reachability of SITE5 is dependent on Site 1's LAN services.

Other than that, I second Ron Maupin's suggestion to question HSRP on the WAN Routers. HSRP only makes sense if the LAN subnet/VLAN is directly attached to the WAN routers.

While this is acceptable for a small spoke site with just a single LAN switch (or single stack-of-switches), and little need for inter VLAN routing, I wouldn't do this on a hierarchical switching environment as found at medium and large sites.

In that case, do as Ron suggests: Use the distribution switch(es) as L3-switch, providing redundancy towards the LAN as the given LAN platform does (stacking, VSS, VPC-Pairing, HSRP, etc.. ), then run one or two "transit VLANs" or "routed ports" from L3-Switch(es) to one or both WAN routers, and let OSPF run across these links. No need for HSRP on the WAN routers, then, not even towards the LAN side.

Oh, and while we're at it, I suggest this:

  • Head towards FlexVPN (essentially that's just DMVPN with sVTI/dVTI tunnel interfaces, plus IKEv2-with-some-clever-benefits, like route-pushing) instead of DMVPN. Personally, I have found IOS/IOS-XE's IKEv2 configuraton style to be cleaner and more precise, and therefore easier to understand and troubleshoot. By comparison, IKEv1 ("crypto isakmp ...") seems convoluted and a lot more "... huh!?" to me - but YMMV. ASR1001-Xs definitely are FlexVPN capable, and all the ISR-G2 generation, too (890, 1900, 2900, 3900), and the ISR 4000 series in any case. The ISR-G1 series (1800, 2800, 3800) however, well, probably they won't.

  • depending on how trusted the WAN service provider is deemed by your customer, consider using "frontdoor VRFs" for the WAN; if the interface towards your carrier connects to a routing instance that has only one single interface, there's no way "through" the router from the carrier network. It's pretty straightforward to set up in IKEv2, PKI client config bits and the sVTI/dVTI interfaces.

Cheers Marc

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.