Avatar of jsctechy
Flag for United States of America asked on

Dual homing a Cisco VPN Router

Hi All,
I need to purchase a new internet switch (8 public IP addresses).  I'm a bit confused as to multi-homing the router.

Currently I have 1 public IP on one interface on the VPN router (Cisco 2691) which connects to the internet switch and one internal IP on my LAN side.  

The idea is that if the internet switch goes down, the VPN traffic could be carried over the other network interface to the new switch.  There is only one ISP, so routing to a separate network isn't possible here.

Any help would be appreciated. Diagram
RoutersVPNSwitches / Hubs

Avatar of undefined
Last Comment

8/22/2022 - Mon
Robert Sutton Jr

What type of service is being delivered and how? When you say "Internet switch" are you referring to your ISP's device? Any chance you can show us a brief net diagram?

We are running IPSEC VPNs over this line, the diagram is attached.

Internet Router --- Internet Switch --- VPN Router.

I want to dual home my VPN router, in the event that internet switch goes down, so I will be purchasing an additional switch to connect in.  

I don't know if I need to use VRRP or GLBP or something else I'm not familiar with.  But the idea is to prevent the VPNs from going down in the even that the original internet switch goes down for whatever reason.
Robert Sutton Jr

Ok..For some reason your diagram didn't show when I 1st posted. You can load share via BGP since you still are going through a single local router.

Here's are some examples:

Hope this helps.
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.

I'm not really sure if BGP is the way to go.  There are a total of 2 routers here.  The idea is to prevent VPNs from dropping.  

So if that internet switch (layer 2) is to go down, I can still have VPN connectivity.  So maybe some type of virtual address solution?

I'm confused about how to physically connect the VPN router, to two switches, both on the same public IP subnet.  I believe the router will tell me the interfaces overlap.

From the diagram I assume the Internet Router is the telco equipment and the switches are yours.
I don't know that you gain much setting up a redundant solution (switches) inbetween two single points of failure (routers).

However, I think setting up virtual interfaces in the routers is the way I would go. It looks like you will also need the Internet Router owner to configure their equipment as well to support this.

The idea is to build out a fully redundant network.  They would like to start with the cheapest- being the two switches.
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.

How would you connect two router interfaces to a single IP subnet?  Won't the router tell you that the interfaces overlap?  I've never had a need to connect two router interfaces to a single IP subnet before.

I have never completed a setup exactly like this. I am also not sure about the capabilities of your router or the Internet router. The physical interfaces would be setup without an IP address or switching ports (like the two switches). A virtual interface would be created with the IP address information you need. One of these routes will be disabled(spanning-tree)  while the other is in operation. If the main link fails (the switch), then the other would come up with access to the same virtual interface. For this to work, both routers would need to be configured similarly.

Virtual Interfaces: http://www.cisco.com/en/US/docs/ios/interface/configuration/guide/ir_cfg_vir_if_ps6350_TSD_Products_Configuration_Guide_Chapter.html


I'm not concerned about supplying failover for the actual VPNs.  I'm concerned about the switch.  

In the diagram there are two Internet switches...  these are just used to distribute the IPs for the public ip subnet we were issued.  If INT SW1 went down, how would my VPN Router use INT SW2?

We are implementing full redundancy throughout the network, however I am confused in how to connect a single router to two different switches for redundancy, in the event the INT SW1 fails.

Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question