1

This is my first post here, so tell me if there's something I'm doing wrong.

I'm currently working with another IT student on our end of degree project and we're building our network in PT. Our current design has 2 LANS that are remotely connected using an IPSec tunnel. Each LAN has 2 routers configured using HSRP. Basic schema of our current config The IPSec tunnel is only configured from the "main" (or rather "active") router in each LAN, therefore, should one of the "main" routers fail, then the 2 LANs would be disconnected. That is not something we can afford, since we'll have Oracle Streams replicating a DB over the IPSec tunnel.

So, my question is, how should we proceed in order to configure a IPSec tunnel that doesn't "die" when a router is down?

Our current idea consists in making a tunnel for each router-to-router connection, making a total of 4 tunnels, but we are unsure whether that's a good practice(probably not) or if its even possible.

Improve this question

1 Answer 1

Reset to default
2

How should we proceed in order to configure a IPSec tunnel that doesn't "die" when a router is down?

There are several ways to accomplish this, depending on the router features and your comfort with the configurations.

You can create two tunnels -- one between the main routers, and one between the backup routers. You can use either a routing protocol between the pairs of routers or IP SLA to determine whether the tunnels are alive.

Using a routing protocol may require using GRE inside of IPSec.

If you use IPSLA, you can then adjust the HSRP priority based on the reachability.

You may have to adjust timers depending on how much convergence time you can tolerate.

Improve this answer
5
  • Thanks for your answer, we'll try to do that. If we created 2 tunnels, it'd be necessary to use IP SLA to check wheter the tunnels are alive or not. Did I get that right?
    – Alex Coronas
    Feb 26, 2019 at 17:08
  • Yes, unless you use a routing protocol.
    – Ron Trunk
    Feb 26, 2019 at 17:09
  • This might be a noob question, but how do I activate the data feature? I need it in order to use ip sla. I've tried on every router in PT and i can't enable it
    – Alex Coronas
    Feb 26, 2019 at 21:24
  • @AlexCoronas What do you mean by "enable data feature?"
    – Ron Trunk
    Feb 27, 2019 at 19:26
  • I meant the "technology-package" datak9. Y'know: "license boot module c2900 technology-package datak9". But Nevermind, apparently Packet Tracer doesn't support it, nor any of the track commands. Therefore I switched to GNS3. Thanks anyway!
    – Alex Coronas
    Feb 28, 2019 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.