Routing
Routing

DR over IPSEC VPN

a week ago

Hello,

 

I am trying to see how to stand up a DR site.

 

Current topology:

Remote site (SRX345 HA) - OSPF via st0 interface with 2 physical external 1G ISP connections with rpm probing and ip-monitoring for failover 

Datacenter site  (SRX1500 HA) - OSPF via st0 interface with 2 physical external 1G ISP connections with rpm probing and ip-monitoring for failover. The IPSEC topology is hub and spoke.  

 

Future Datacenter will be: 

Edge 1 (srx1500 no HA) - 1G connection to ISPA

Edge 2 (srx4200) - 10G connection to ISPB

Edge 2 (srx4200) - Additional 10G connection to disaster recovery (secondary datacenter) with the same equipment for replication.

 

Remote sites need to have local ISP failover to support the tunnel locally as well tunnel connections to the primary and secondary datacenter. 

 

Questions:

1. How can you configure OSPF so that there is no asymmetric routing?

 

2. How can you configure IPSEC tunnels so that the remote sites can failover between primary and secondary datacenter?

 

Any assistance would be greatly appreciated.  

 

Sincerely, 

 

Under Pressure

1 REPLY 1
Routing

Re: DR over IPSEC VPN

a week ago
1. How can you configure OSPF so that there is no asymmetric routing?

2. How can you configure IPSEC tunnels so that the remote sites can failover between primary and secondary datacenter?

Create separate vpn tunnels on each ISP with separate st0 interfaces to all the sites.

For example, 2 ISP at backup site gets two tunnels to the single ISP at the other sites.

 

The direct link from the primary data center would come in on another interface.

 

Setup your OSPF on all of the links and use the link cost metric in OSPF to have the routes prioritized in the order you want the links to be used.  

 

As each option fails the ospf routing table will automatically shift the traffic in the desired order on both sides keeping the traffic symetrical.

 

 

Steve Puluka BSEET - Juniper Ambassador
IP Architect - DQE Communications Pittsburgh, PA (Metro Ethernet & ISP)
http://puluka.com/home