Hello all,
I’ve currently got a series of GRE tunnels going between Cisco routers over Pix-terminated IPSEC VPNs. The GRE tunnels are there to enable EIGRP updates to pass, thereby allowing automatic failover of the VPNs to a secondary link. Those routers are inside the Pix firewalls. Everything is working OK (pre-failover testing) -- routing updates passing, etc. But all traffic, tunneled and not tunneled, is going over the same physical Internet link. What I’d like to do is to reroute traffic that is not going over the vpns to go over the secondary Internet link at each site instead. In other words, inside hosts browsing – and downloading from – the Internet should use the relatively dormant secondary failover link for that traffic, while the primary link is used for the mission-critical vpn to the other company facility.
To illustrate, three devices involved at each site – one Cisco 3640 on the inside, connected via Eth1 to PixA (primary link), and connected via Eth2 to PixB (secondary link). Each Pix connects to its own Internet link. For our purposes, PixB is dormant, and PixA is handling all Internet-bound traffic, tunneled or not. The 3640 has a default gateway of PixA inside interface (directly, and not through GRE tunnel). Inside hosts all have the 3640 as default gateway.
Working with just one remote site at the moment, I notice that I can enter a static route on the 3640 to a particular web site, and an inside host will be directed to that site via PixB (the secondary link), without a problem. However, when I take it a step further and change the default route on the 3640 to PixB (directly to PixB inside interface), the entire VPN to the central site comes down --neither PixA nor the 3640 can get to anything on the other side. I don’t know why this should be. Although I changed the default route, routing updates should still be advertised and sent over the primary GRE tunnel, using a specific source and destination address, connecting to the same PixA, going over the same primary link. In fact, the routing table looks exactly the same afterwards except for the changed default route. And ‘debug tunnel’ shows no errors. Also, on the Pix firewall, the vpn still shows as being intact. But all connectivity has been lost. It’s as though I need to enter some static routes on the 3640 to reinforce what EIGRP is providing.
Any suggestions would be appreciated.
I’ve currently got a series of GRE tunnels going between Cisco routers over Pix-terminated IPSEC VPNs. The GRE tunnels are there to enable EIGRP updates to pass, thereby allowing automatic failover of the VPNs to a secondary link. Those routers are inside the Pix firewalls. Everything is working OK (pre-failover testing) -- routing updates passing, etc. But all traffic, tunneled and not tunneled, is going over the same physical Internet link. What I’d like to do is to reroute traffic that is not going over the vpns to go over the secondary Internet link at each site instead. In other words, inside hosts browsing – and downloading from – the Internet should use the relatively dormant secondary failover link for that traffic, while the primary link is used for the mission-critical vpn to the other company facility.
To illustrate, three devices involved at each site – one Cisco 3640 on the inside, connected via Eth1 to PixA (primary link), and connected via Eth2 to PixB (secondary link). Each Pix connects to its own Internet link. For our purposes, PixB is dormant, and PixA is handling all Internet-bound traffic, tunneled or not. The 3640 has a default gateway of PixA inside interface (directly, and not through GRE tunnel). Inside hosts all have the 3640 as default gateway.
Working with just one remote site at the moment, I notice that I can enter a static route on the 3640 to a particular web site, and an inside host will be directed to that site via PixB (the secondary link), without a problem. However, when I take it a step further and change the default route on the 3640 to PixB (directly to PixB inside interface), the entire VPN to the central site comes down --neither PixA nor the 3640 can get to anything on the other side. I don’t know why this should be. Although I changed the default route, routing updates should still be advertised and sent over the primary GRE tunnel, using a specific source and destination address, connecting to the same PixA, going over the same primary link. In fact, the routing table looks exactly the same afterwards except for the changed default route. And ‘debug tunnel’ shows no errors. Also, on the Pix firewall, the vpn still shows as being intact. But all connectivity has been lost. It’s as though I need to enter some static routes on the 3640 to reinforce what EIGRP is providing.
Any suggestions would be appreciated.
