Ha Gre Hub and Spoke
Figure 10-31 shows the topology for an HA GRE hub-and-spoke design. Note that the GRE tunnel IP addresses are not shown to avoid cluttering the diagram. They are defined in the same manner as the previous design.
Figure 10-31. HA GRE Hub-and-Spoke Design
Figure 10-31. HA GRE Hub-and-Spoke Design
Here you can see that R10 has a primary tunnel to R50 and a secondary tunnel to R40. R20 is configure just the opposite. Bandwidth metrics are placed on the GRE links to specify path preference. Since most the configuration for these devices is the same, only R50's and R10's configurations are shown.
The IPsec-relevant portions of R50's configuration are as follows:
version 12.2 !
hostname r50 !
crypto isakmp policy 1 encr aes 256
authentication pre-share group 5
! Here 2 new keys are defined for the connections to R10 and R20 crypto isakmp key 0uHgp;':;RHCSBA address 69.1.20.20
crypto isakmp key kILNtNiBe8Syoby) address 69.1.10.10 !
crypto ipsec transform-set dsen esp-aes 256 esp-sha-hmac mode transport
crypto map vpn local-address FastEthernet0/0 crypto map vpn 10 ipsec-isakmp set peer 69.1.10.10 set transform-set dsen set pfs group5 match address 101 crypto map vpn 20 ipsec-isakmp set peer 69.1.20.20 set transform-set dsen set pfs group5 match address 102
! GRE interfaces default to 9Kbps in default bandwidth. In order to have a ! particular GRE tunnel be preferred over another, you merely modify ! the bandwidth up or down depending on the desired result. Here, ! since R50 is primary for R10, the GRE tunnel to R10 is given ! a bandwidth statement of 1000Kbps interface Tunnel0 bandwidth 1000
ip address 10.15.1.50 255.255.255.0 ip mtu 1438 keepalive 10 3
tunnel source FastEthernet0/0 tunnel destination 69.1.10.10
interface Tunnel1 ip address 10.25.1.50 255.255.255.0 ip mtu 1438 keepalive 10 3
tunnel source FastEthernet0/0 tunnel destination 69.1.20.20
interface FastEthernet0/0 ip address 69.1.45.50 255.255.255.0 crypto map vpn
interface FastEthernet0/1 ip address 10.45.0.50 255.255.0.0
router eigrp 100 network 10.0.0.0 auto-summary
access-list 101 permit gre host 69.1.45.50 host 69.1.10.10 access-list 102 permit gre host 69.1.45.50 host 69.1.20.20
The IPsec-relevant portions of R10's configuration are as follows:
version 12.2 !
hostname r10 !
crypto isakmp policy 1 encr aes 256
authentication pre-share group 5
! The key for R50 is added to the configuration crypto isakmp key |n%;( o(mi,iRNK1 address 69.1.45.40
crypto isakmp key kILNtNiBe8Syoby) address 69.1.45.50 !
crypto ipsec transform-set dsen esp-aes 256 esp-sha-hmac mode transport
! A second crypto map instance is added for the connection to R50. crypto map vpn local-address FastEthernet0/0 crypto map vpn 10 ipsec-isakmp set peer 69.1.45.40 set transform-set dsen set pfs group5 match address 101 crypto map vpn 20 ipsec-isakmp set peer 69.1.45.50 set transform-set dsen set pfs group5 match address 102
interface Tunnel0 ip address 10.14.1.10 255.255.255.0 ip mtu 1438 keepalive 10 3
tunnel source FastEthernet0/0 tunnel destination 69.1.45.40
! Since R50 is the primary head end for R10, bandwidth is set higher to cause ! R10 to prefer the link to R50 over the link to R40 interface Tunnel1 bandwidth 1000
ip address 10.15.1.10 255.255.255.0 ip mtu 1438 keepalive 10 3
tunnel source FastEthernet0/0 tunnel destination 69.1.45.50
interface FastEthernet0/0 ip address 69.1.10.10 255.255.255.0 crypto map vpn
interface FastEthernet0/1 ip address 10.10.0.10 255.255.0.0
router eigrp 100 network 10.0.0.0 auto-summary
access-list 101 permit gre host 69.1.10.10 host 69.1.45.40 access-list 102 permit gre host 69.1.10.10 host 69.1.45.50
When you look at the routing table for R10, you can see these preferences reflected in the routing:
r10#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default, U - per-user static route, o - ODR P - periodic downloaded static route
Gateway of last resort is 69.1.10.100 to network 0.0.0.0
69.0.0.0/24 is subnetted, 1 subnets C 69.1.10.0 is directly connected, FastEthernet0/0
10.0.0.0/8 is variably subnetted, 7 subnets, 2 masks
|
C |
10. |
. 10. |
0 |
.0/16 |
is directly connected, FastEthernet0/1 |
|
|
C |
10. |
, 15. |
1 |
.0/24 |
is directly connected, Tunnel1 |
|
|
C |
10. |
, 14. |
1 |
.0/24 |
is directly connected, Tunnel0 |
|
|
D |
10. |
.25. |
1 |
.0/24 |
[90/310044416] via 10.15.1.50, 00:22:02 |
, Tunnel1 |
|
D |
10, |
. 24. |
1 |
.0/24 |
[90/28162560] via 10.15.1.50, 00:12:07, |
Tunnel1 |
|
D |
10, |
.20. |
0 |
.0/16 |
[90/28165120] via 10.15.1.50, 00:11:58, |
Tunnel1 |
|
D |
10. |
. 45. |
0 |
.0/16 |
[90/15362560] via 10.15.1.50, 00:12:30, |
Tunnel1 |
|
S* |
0.0.0. |
0/0 |
1/0] |
via 69.1.10.100 |
If R50 goes down, R40 takes over for R10's traffic as quickly as the routing protocol is configured to converge. Here you can see the console message after the failure and the new routing table:
[View full width]
3d17h: %DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor 10.15.1.50 (Tunnel1) is down: holding t ime expired r10#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default, U - per-user static route, o - ODR P - periodic downloaded static route
Gateway of last resort is 69.1.10.100 to network 0.0.0.0
69.0.0.0/24 is subnetted, 1 subnets C 69.1.10.0 is directly connected, FastEthernet0/0
10.0.0.0/8 is variably subnetted, 7 subnets, 2 masks C 10.10.0.0/16 is directly connected, FastEthernet0/1
C 10.15.1.0/24 is directly connected, Tunnel1
C 10.14.1.0/24 is directly connected, Tunnel0
D 10.25.1.0/24 [90/322844416] via 10.14.1.40, 00:00:09,
D 10.24.1.0/24 [90/310044416] via 10.14.1.40, 00:00:10,
D 10.20.0.0/16 [90/310046976] via 10.14.1.40, 00:00:11,
D 10.45.0.0/16 [90/297246976] via 10.14.1.40, 00:00:11,
Tunnel0 Tunnel0 Tunnel0 Tunnel0
Notice that now all routes go through TunnelO to R40. When the link comes back up, the routes will swil back.
3d17h: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnell, changed state to up 3d17h: %DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor 10.15.1.50 (Tunnell) is up: new adjac
Continue reading here: Psec Outsourcing
Was this article helpful?