Question about redundent paths with IPSEC Tunnels.

[cengasser]

I have a HA-pair of 3050s in my corp office with an single existing IPSEC tunnel to a remote office on a 200.

The remote office has very poor reliability on it's existing connection and the local ISP has provided them with a backup satcom link they can use when the prime connection goes down.

the HA-pair sits behind a Single IP that's managed via BGP on a HA-pair of routers with redundent internet links. The main IP will float between the routers using HSRP.

If it was only a matter of flipping a route on the remote 200, it wouldn't be an issue, but how do I get the tunnel to migrate from one local IP to another?

Thanks.

[pulukas]

For this type of setup, I would remove the static route on the VPN tunnel.  And setup OSPF on the tunnel interfaces between the remote site and the cluster.

You can then have two VPN active at all times and use OSPF cost on the back link to make sure it is less preferred.

If you are not running OSPF currently on the HA PA, you can import these remote side routes into your BGP setup.

On the remote side set the LAN interfaces there to passive OSPF so that their subnets get advertised up both tunnel neighbors.