Dual homing a Cisco VPN Router

jsctechy
jsctechy used Ask the Experts™
on
Hi All,
I need to purchase a new internet switch (8 public IP addresses).  I'm a bit confused as to multi-homing the router.

Currently I have 1 public IP on one interface on the VPN router (Cisco 2691) which connects to the internet switch and one internal IP on my LAN side.  

The idea is that if the internet switch goes down, the VPN traffic could be carried over the other network interface to the new switch.  There is only one ISP, so routing to a separate network isn't possible here.

Any help would be appreciated. Diagram
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Robert Sutton JrSenior Network Manager

Commented:
What type of service is being delivered and how? When you say "Internet switch" are you referring to your ISP's device? Any chance you can show us a brief net diagram?
jsctechyInfrastructure Team Lead

Author

Commented:
Hello,
We are running IPSEC VPNs over this line, the diagram is attached.

Internet Router --- Internet Switch --- VPN Router.

I want to dual home my VPN router, in the event that internet switch goes down, so I will be purchasing an additional switch to connect in.  

I don't know if I need to use VRRP or GLBP or something else I'm not familiar with.  But the idea is to prevent the VPNs from going down in the even that the original internet switch goes down for whatever reason.
Robert Sutton JrSenior Network Manager

Commented:
Ok..For some reason your diagram didn't show when I 1st posted. You can load share via BGP since you still are going through a single local router.

Here's are some examples:
http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a00800945bf.shtml#conf2

Hope this helps.
jsctechyInfrastructure Team Lead

Author

Commented:
I'm not really sure if BGP is the way to go.  There are a total of 2 routers here.  The idea is to prevent VPNs from dropping.  

So if that internet switch (layer 2) is to go down, I can still have VPN connectivity.  So maybe some type of virtual address solution?

I'm confused about how to physically connect the VPN router, to two switches, both on the same public IP subnet.  I believe the router will tell me the interfaces overlap.

Commented:
From the diagram I assume the Internet Router is the telco equipment and the switches are yours.
I don't know that you gain much setting up a redundant solution (switches) inbetween two single points of failure (routers).

However, I think setting up virtual interfaces in the routers is the way I would go. It looks like you will also need the Internet Router owner to configure their equipment as well to support this.
jsctechyInfrastructure Team Lead

Author

Commented:
The idea is to build out a fully redundant network.  They would like to start with the cheapest- being the two switches.
jsctechyInfrastructure Team Lead

Author

Commented:
How would you connect two router interfaces to a single IP subnet?  Won't the router tell you that the interfaces overlap?  I've never had a need to connect two router interfaces to a single IP subnet before.

Commented:
I have never completed a setup exactly like this. I am also not sure about the capabilities of your router or the Internet router. The physical interfaces would be setup without an IP address or switching ports (like the two switches). A virtual interface would be created with the IP address information you need. One of these routes will be disabled(spanning-tree)  while the other is in operation. If the main link fails (the switch), then the other would come up with access to the same virtual interface. For this to work, both routers would need to be configured similarly.

Virtual Interfaces: http://www.cisco.com/en/US/docs/ios/interface/configuration/guide/ir_cfg_vir_if_ps6350_TSD_Products_Configuration_Guide_Chapter.html



jsctechyInfrastructure Team Lead

Author

Commented:
I'm not concerned about supplying failover for the actual VPNs.  I'm concerned about the switch.  

In the diagram there are two Internet switches...  these are just used to distribute the IPs for the public ip subnet we were issued.  If INT SW1 went down, how would my VPN Router use INT SW2?

We are implementing full redundancy throughout the network, however I am confused in how to connect a single router to two different switches for redundancy, in the event the INT SW1 fails.

Commented:
In a previous post...you wanted to keep the VPN services up in case of a switch failure. I was under the impression you only had one (1) public IP address to work with. The protocols you mentioned previously have to do with router services..not layer 2 switches. I think a more detailed physcal and logical diagram are needed to find a solution for what you are proposing.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial