Route Priorities with Crypto Maps for duplicate destination networks, failover VPN

Posted on 2007-12-04
Medium Priority
Last Modified: 2012-05-05
Here is the scenario. We have a hub and spoke point-to-point T1 infrastructure to our remote offices, obviously converging at our HQ. We have brought in DSL connections to each remote office as well, and plan to offload HTTP traffic through the DSL. We also want to use this DSL connection for a Site-to-Site VPN back to HQ if/when the T1 fails.

We are using Cisco 2600-series routers for the T1 links. We want to purchase Cisco 871 routers for the remote offices to provide firewall/vpn services.

Our Cisco routers hosting the T1 connections talk to each other through EIGRP. We plan on using route redistribution for RIP so the Cisco 871 (default IOS doesn't do EIGRP) can get these routes when the T1 is up and route the appropriate traffic over it. When the T1 fails, the routes will dissappear from the RIP advertisements and the Cisco 871 will stop sending corporate traffic to the 2600 router and hopefully start to use its Crypto map to send that traffic. We want the VPN to be 100% idle until the T1 goes down, in fact, it would be best if the VPN never even dialed until it was needed.

Here is the question, when a crypto map exists for a certain destination network in a Cisco device, is it smart enough to NOT use the crypto map for that network when it is also receiving routes from a dynamic routing protocol for the same network? Can you set administrative distances on crypto traffic?
Question by:Lweighall
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
LVL 79

Expert Comment

ID: 20407582
> when a crypto map exists for a certain destination network in a Cisco device, is it smart enough to NOT use the crypto map for that network
Actually, yes. There is no heartbeat or keepalive. The tunnel is never active unless and until there is actual traffic that meets the interesting traffic as you have defined by access-list.
Your plan is solid. You don't need to set administrative distances on crypto traffic because it will simply use the default route as long as there is no other learned route more specific.

Author Comment

ID: 20408037
Thank you for your response.

Just to be clear I'd like to throw a more direct question at you. On the same Cisco device there exists a crypto map/ACL for the network, but it also has a route in its table for the through a router on its subnet, it will always prefer the route in the table learned from the other router over its own Crypto ACL? If not, can I set it to?

Sorry for the redundancy here, I just want to be crystal clear.

LVL 79

Accepted Solution

lrmoore earned 2000 total points
ID: 20408158
Yes, it will always prefer the more explicit route. Routes are always chosen by best match, not first match.

Author Closing Comment

ID: 31412705
Thank you.

Featured Post

Ransomware Attacks Keeping You Up at Night?

Will your organization be ransomware's next victim?  The good news is that these attacks are predicable and therefore preventable. Learn more about how you can  stop a ransomware attacks before encryption takes place with our Ransomware Prevention Kit!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Suggested Courses

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question