VPN Failover Question

abhustler

I have what I thought was a simple task but i am having trouble figuring out how to implement it. I currently have a cisco 5510 connected to an internet router and a MPLS router. The MPLS connection is new and we previously communicated with our branch office subnets through a vpn tunnel i have configured on the ASA. Now that we are getting a MPLS connection traffic destined for the branch subnets will go through the MPLS connection. However I still want to keep the VPN as a failover in the event MPLS fails. I'm just not sure how I can tell the ASA to use the vpn only if the MPLS connection is down. Does anyone know if i have both a vpn connection and static routes for the same remote subnets pointing to my MPLS router will the ASA prefer the static routes and only use the vpn if the routes are not in the table? Any information would be appreciated.

jason_lunde

Ya dude. Just use the interface tracking feature. Drop the static route if its down..and let it just use the default. Leave your NAT statements in the ASA for the tunnel...it should see interesting traffic and use the tunnel if that primary route is down...I am pretty sure routing comes before nat in ASA order of ops.

chrisone

Yeah definitely use tracked routes

mzbagasra

What is interface tracking feature?

jason_lunde

mzbagasra wrote: »

What is interface tracking feature?

ASA/PIX 7.x: Redundant or Backup ISP Links Configuration Example - Cisco Systems

burbankmarc

I have this exact same setup, but I handle the VPN connections on the routers connected to the internet. This way I can create gre tunnels and either inject static routes into OSPF, or add the VPN connection into OSPF.

mrblackmamba343

GRE Tunnels over the IPSEC

use a routing protocol to pick the best path, which I assume will be the MPLS

APA

burbankmarc wrote: »

I have this exact same setup, but I handle the VPN connections on the routers connected to the internet. This way I can create gre tunnels and either inject static routes into OSPF, or add the VPN connection into OSPF.

+1 - I was going to suggest this.... however burbank already covered it..... Let a routing protocol make the decision... have a higher metric on the GRE routing-protocols adjacency over the IPSec VPN.

Thus MPLS VPN will always be preferred unless it is down....

If its not possible to deploy this... then tracked routes would be the way to go...

jason_lunde wrote:

I am pretty sure routing comes before nat in ASA order of ops.

That is correct... for egress traffic NAT is after routing.... for ingress traffic to the ASA NAT is before routing..