Backup Internet with Ipsec VPN doing BGP

CaseyAnderson — Mon, 21 Apr 2025 15:26:57 GMT

Hello,

Mostly just need a sanity check on this configuration.

I am setting up a backup internet for one of our hub sites as a failover.

Currently the connection to the other primary sites is via a IPsec tunnel using iBGP to pass routes between the "Hub" sites as well as redist into OSPF for internal traffic and routing to spokes.

The External VR has a default route to the primary ISP with path monitoring set to metric 10, and a second default route to the backup ISP on metric 100.

I have created new tunnel interfaces, ike gateways and ipsec tunnels on both sides for the backup internet connection under a different subnet

I am adding the second tunnel to the same Peer groups (one for each Hub Connection).

From my understanding I shouldn’t need to worry about adjusting the new peers AS, MED, etc. in the peer groups as only one of the sessions could be alive at any given time due to the external routers default route metrics.

Am I missing anything here, and even through I shouldn't have to set the new peers to only be used as a failover connection in BGP should I do it anyway?

topic Backup Internet with Ipsec VPN doing BGP in General Topics

Backup Internet with Ipsec VPN doing BGP