2

I have this situation:

network diagram

Remote location with 6 devices collecting data and each connected to two VPN routers. Bonding is set up for those computers and data is sent to multicast address. Each VPN router then acts as a VPN server with own connection to internet. Physical access to remote location takes long time and it is necessary to eliminate single point of failure.

On local site is multiple computers which receives the multicasted data. So I would like the whole LAN to connect to remote location via another VPN router (site to site connection) to both VPNs at the same time (automatic switch to backup connection type) In future there may me more local sites.

What I observed: 1) Is it necessary for the routers to support Spanning tree protocol since there will be rings? 2) Is it possible for multicast to go thru VPN?

  • Removed the off-topic request for recommendations. – Ron Maupin Apr 27 '18 at 12:19
2

Is it necessary for the routers to support Spanning tree protocol since there will be rings?

Spanning Tree is a layer-2 loop prevention. It is useful if you are creating a single layer-2 LAN (not recommended across a WAN), but it is blocked if the network uses layer-3 (routed) connections (most likely, but you have not included any information to determine that).

Is it possible for multicast to go thru VPN?

That depends on the specific tunneling protocol in use. Some tunnel protocols support multicast, and some do not. Multicast routing is very different from unicast routing, and all routers in the path of the multicast packets must support and be configured for multicast routing.

  • There won't be any other devices. Only those on the image and few more computers connected directly to vpn routers. In the future we would like to add another "local site" connected to the same remote location. – Metaathron May 4 '18 at 19:34
2

1) Is it necessary for the routers to support Spanning tree protocol since there will be rings?

No, IPSec tunnels are layer 3 (sort of). They don't pass layer 2 frames.

2) Is it possible for multicast to go thru VPN?

IPSec is unicast, so NO.

In order to use multicast, you will either have to establish GRE tunnels (over IPSec), or use VTI interfaces (if you're using Cisco devices).

But I don't understand why you have redundant devices on one side, but only a single device on the other. That doesn't really help provide more availability. You may need to run a routing protocol to determine which tunnel to use.

  • 1
    "But I don't understand why you have redundant devices on one side, but only a single device on the other. That doesn't really help provide more availability. " it does if the "time to repair" at the remote site is much higher than at the local site. Also it may not be the VPN routers themselves that are the problem but that the locally available internet connections are shitty. – Peter Green Apr 27 '18 at 16:28
  • That's the exact problem. We can repair the local devices very fast and we have stable connection. On the other side, we have to travel quite a long way to remote site since it is not in civilisation and there is sh*tty connection. – Metaathron May 4 '18 at 19:28
  • @Metaathron Cisco routers have a feature called optimized edge routing which can probe both VPN tunnels and route over the better one. – Ron Trunk May 4 '18 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.