Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Cisco > This is heady - DMVPN / HSRP

Reply
Thread Tools

This is heady - DMVPN / HSRP

 
 
V. Evans
Guest
Posts: n/a
 
      11-18-2005
I am trying to mix two Cisco technologies and I am not have much luck,
but I am pretty confident what I am trying to do can be done. Here's
the setup:

My company has two Cisco 2800 routers with IPSec and FW IOS, which are
used for shared VPN services. They only have two fastethernet
interfaces, which are sub-interfaced for various customers (trunking).
I am wanting to run HSRP on both the inside and outside - no problem. I
also want to create DMVPN connections for some customers. That, in
itself is no problem.....

The problem is mixing HSRP (and the IPSec redundancy features with
replicating the SA database between two routers) with DMVPN and more
specifically with the Tunnel interface(s) created with GRE Multicast.

Since my two VPN routers will have one HSRP address, which will end up
being the public address used by customers as the VPN peer address, how
is this one address referenced / related to the GRE tunnels that are
created? You can't create standby ip's on Tunnel interfaces, however it
seems to me you would need to be able to do that somehow.

One option I was thinking about is that, since one of my VPN routers
will be a standby device (not active with HSRP address), then maybe I
could give that router's tunnel interface the same IP address as that
of the tunnel interface on the active router. In theory, this would not
necessarily cause a duplicate-IP issue because that router isn't
answering for packets destined for the standby ip anyway.

I don't want to get too deep - I probably haven't explained it very
well, but I am setting this up and I am basically stuck. My tunnel
interfaces are up, but line protocol is down with a message that the
interface doesn't know the destination point of the tunnel subnet.

 
Reply With Quote
 
 
 
 
Merv
Guest
Posts: n/a
 
      11-18-2005
While Cisco does provide for use of HSRP for IPSEC tunnel high
availability, it does not appear that this approach is used for DMVPN
GRE tunnels.

For DMVPM hub redundancy, see Cisco docs on DMVPN dual hub design:
http://www.cisco.com/en/US/tech/tk58...#dualhubsingle

 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
DMVPN Help Glenn Rowe Cisco 0 09-13-2004 01:41 PM
EIGRP and DMVPN j Cisco 2 06-23-2004 01:25 PM
827-4V and DMVPN?? Adrian Cisco 0 12-23-2003 03:40 PM
DMVPN and duplicate subnets Christian Knoblauch Cisco 0 12-23-2003 11:35 AM
OSPF routing over DMVPN tunnel ... Garry Glendown Cisco 4 11-15-2003 09:37 PM



Advertisments