Load balancing inbound IPSec GRE tunnels

Posted on 2009-12-28
Medium Priority
Last Modified: 2012-05-08
I have 1200 sites (site to site, no client VPN software) that I want to connect using DMVPNs, hub and spoke style. I am trying to figure out how to get head-end redundancy and reliability. I'm thinking that I could load balance the inbound tunnel connections and I cant think of a reason why not. I'd use pre-shared keys and load balance using Catalyst 6500 with server load balancing, and farm out the IPSec/GRE tunnels based on data volume or number of connected tunnels.


I haven't done anything like this on this scale and need some help.
Question by:SteveJ
  • 2
  • 2
LVL 81

Expert Comment

ID: 26135623
Do you need spoke to spoke communication?
Do you have tiered locations with better connectivity than others?

i.e. site's a, b, c have very high availalbe bandwith T1,DS3
sub-sites d, e, f have partial T's or Frame
the rest have have DSL

An alterntive to hub and spoke might be a mesh which would also provide for convergence in the event a particular network path is not available.

sitea, siteb, sitec will be connected by DMVPN amongst themselves.
Each would have a bunch of spokes and each spoke will have a VPN connection to two or three other spokes of equal bandwidth

using routing protocol i.e. ospf or BGP you can route the inter-spoke and all the way up to any node.

The only thing is that all sites have to have unique LAN segments or you would need to compensate for that using IP transforms/translation.
LVL 16

Author Comment

ID: 26137836
Actually, I don't want spoke to spoke communication, and, yes, there are variations from site to site regarding bandwidth. To be honest, a peer suggested DMVPN because she'd read something about it but has no direct experience. I will need to do some multicast so that's why I am looking at DMVPN further. The real issue to me is head-end redundancy which I hope to be able to provide with load balancing and IPSec stateful failover.

So . . . load balancing at the head end? You think this can be done?

Thanks for the response Arnold

LVL 81

Accepted Solution

arnold earned 1500 total points
ID: 26138115
Here is an example of a DMVPN setup hub-spoke with eigre route advertising.

Ref: ip nhrp nhs and ip nhrs map multicast dynamic ip nhrp map where you can define multiple hops/routers

Presumably, you have two separate connections between which you want the traffic load distributed.

see if the examples help you get further along on your research.
LVL 16

Author Closing Comment

ID: 31670558
Thanks for responding . . .

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

OpenVPN is a great open source VPN server that is capable of providing quick and easy VPN access to your network on the cheap.  By default the software is configured to allow open access to your network.  But what if you want to restrict users to on…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question