Routing and automatic failover

[ChrisA]

We are running CheckPoint NGX HFA02 on IPSO 3.9. Currently we use only static routes.

We have a dedicated TLS (using Cisco routers, also with static routes) to another company, and we would like to provide an automatic failover to a site-to-site VPN connection through the Internet. We have the VPN definitions in place and they have been tested. I've disabled the Encrypt rules so that the tunnel does not start. I have a separate set of Accept rules for the normal TLS traffic.

Is it possible to provide an automatic failover from the TLS connection to a VPN tunnel, and if so, how can this be done? I'm thinking we need to configure dynamic routing on both the f/w and the routers, but I'm not sure of all I need to do, or if it's even possible. Any advice/guidance would be appreciated. Thank you.

[chillyjim]

If the other side is NGX, take a look at route based VPN basically what you end up doing is keeping the p2p line and add an IP-in-IP tunnel. Using the routing protocol of your choice (OSPF/RIPv2/BGP/PIM/??) you weight the routes so if the p2p is up it gets used, if it goes away the VPN gets used.

Its a PIA to set up the first time, but it does work well.

[ChrisA]

Thank you, chillyjim. The other side is a PIX, so unfortunately your suggestion is not an option for us. If you or anyone else out there has any other ideas/thoughts, please let me know.

[Afontanilla]

I'll try to set this up in a lab... I have been trying to push this idea forever..If someone is out there that can collaborate with me to have a "real world" test that would be great...

I can set this up using two cisco 3555 multi-layer switches and two IP 650 vpn tunnels devices....but that would only tell me if it works internally in a lab....I need to test this on a frame network with the failover network using the internet connection..

1. Set up a Cisco secure tunnel through a VPN that is always on.. We will term this "Failover Tunnel" Of course, another cisco device on the far side is passing routing information via an eigrp or OsPF. (Be very careful here with metrics or you can have a nice routing loop that will cause your network to crash)

2. put a higher cost on this "Failover Tunnel" path via ciscos metric commands.

3. When the "Primary" path (be it a vpn, Frame Relay, ATM etc) fails the always up (Fail-over Internet) tunnel will save the day..

My only real concern is the possible routing loop that might be created due the possible failover paths that Cisco will see...I would be conservative and actually place a high or near-infinite cost value on this Fail-over path in OSPF or EIGRP.(uugh and this gets a little sloppy because hard-wiring costs is not ideal in dynamic routing networks but I dont see any other way)

It may also be possible to load balance using the the internet failover tunnel but thats for another thread...

OK posting up visio Diagrams and routing table costs this week..
Afontanilla
Northeast NJ
"Cisco and Nokia/Checkpoint happy together"