I have a network with resilient gateways whereby Customer sites use a default gateway to reach the internet edge routers and the primary route for traffic uses a lower metric.
ipsec tunnels are initiated from vpn concentrators behind the edge routers and are statically configured to the destination tunnel endpoints which are 3rd party data centers. I am not able to use a dynamic routing protocol with the 3rd party.
The problem is that the peering address range that the 3rd party is using periodically changes and brings down the primary tunnel and a manual switch to the secondary tunnel is being cumbersomely carried out.
- Can how can I most efficiently failover between tunnels in this scenario if the destination IPs are not reliable for the static ipsec configuration?
- How would I pre-empt the primary tunnel once the endpoint becomes available?