I'll start with what I'm trying to accomplish. I have two tunnels on a router connecting back to two separate routers at my central location across two separate internet ISPs via a DMVPN. Both tunnels connect and share dynamic routing information appropriately and work in every aspect they should.
I want one of those tunnels (Tun1) to be a backup for the other one (Tun0) so that Tun1 is only active in the event Tun0 goes down. I am currently using the Backup command to make Tun1 the backup interface for Tun0. The problem with tunnels is that they always show up even if they don't have connectivity to the other end. This means I just need to use Keepalive on the primary tunnel so it checks to see if it has connectivity to the destination IP. The problem I encounter is the destination IP address is NAT'd at my central location, so the Keepalive packet never makes it to the router terminating the VPN tunnel since the address in the Keepalive packet doesn't get translated. This means the tunnel is brought down until the Keepalive command is removed.
Does anyone know of a work-around for this issue or another way to go about building two tunnels where one is primary and the other is a backup?
Here is a simple diagram of where the devices live in reference to each other:
[Central VPN Router] --- [ASA Firewall] --- [Internet] --- [Remote Router w/two tunnels]
Here's the router config for Tun0 (Tun1 is practically the same without the backup commands):
interface Tunnel0
backup delay 0 120
backup interface Tunnel1
ip address 172.168.1.10 255.255.255.0
ip helper-address 192.168.1.100
ip mtu 1400
ip nhrp authentication password
ip nhrp map 192.168.100.1 700.700.700.700
ip nhrp map multicast 700.700.700.700
ip nhrp network-id 100
ip nhrp holdtime 300
ip nhrp nhs 192.168.100.1
ip tcp adjust-mss 1360
ip ospf authentication message-digest
ip ospf message-digest-key 10 md5 7 encryptedpw
ip ospf network broadcast
tunnel source FastEthernet8
tunnel destination 700.700.700.700
tunnel key 100
tunnel protection ipsec profile DMVPN
The 700.700.700.700 is the internet ip of our VPN router made available via a NAT'd internal address on our ASA.
