Load balancing inbound IPSec GRE tunnels

Posted on 2009-12-28
Last Modified: 2012-05-08
I have 1200 sites (site to site, no client VPN software) that I want to connect using DMVPNs, hub and spoke style. I am trying to figure out how to get head-end redundancy and reliability. I'm thinking that I could load balance the inbound tunnel connections and I cant think of a reason why not. I'd use pre-shared keys and load balance using Catalyst 6500 with server load balancing, and farm out the IPSec/GRE tunnels based on data volume or number of connected tunnels.


I haven't done anything like this on this scale and need some help.
Question by:SteveJ
    LVL 76

    Expert Comment

    Do you need spoke to spoke communication?
    Do you have tiered locations with better connectivity than others?

    i.e. site's a, b, c have very high availalbe bandwith T1,DS3
    sub-sites d, e, f have partial T's or Frame
    the rest have have DSL

    An alterntive to hub and spoke might be a mesh which would also provide for convergence in the event a particular network path is not available.

    sitea, siteb, sitec will be connected by DMVPN amongst themselves.
    Each would have a bunch of spokes and each spoke will have a VPN connection to two or three other spokes of equal bandwidth

    using routing protocol i.e. ospf or BGP you can route the inter-spoke and all the way up to any node.

    The only thing is that all sites have to have unique LAN segments or you would need to compensate for that using IP transforms/translation.
    LVL 16

    Author Comment

    Actually, I don't want spoke to spoke communication, and, yes, there are variations from site to site regarding bandwidth. To be honest, a peer suggested DMVPN because she'd read something about it but has no direct experience. I will need to do some multicast so that's why I am looking at DMVPN further. The real issue to me is head-end redundancy which I hope to be able to provide with load balancing and IPSec stateful failover.

    So . . . load balancing at the head end? You think this can be done?

    Thanks for the response Arnold

    LVL 76

    Accepted Solution

    Here is an example of a DMVPN setup hub-spoke with eigre route advertising.

    Ref: ip nhrp nhs and ip nhrs map multicast dynamic ip nhrp map where you can define multiple hops/routers

    Presumably, you have two separate connections between which you want the traffic load distributed.

    see if the examples help you get further along on your research.
    LVL 16

    Author Closing Comment

    Thanks for responding . . .

    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Join & Write a Comment

    AWS has developed and created its highly available global infrastructure allowing users to deploy and manage their estates all across the world through the use of the following geographical components   RegionsAvailability ZonesEdge Locations  Wh…
    Let’s list some of the technologies that enable smooth teleworking. 
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    745 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    14 Experts available now in Live!

    Get 1:1 Help Now