Routing traffic through a network of VPN tunnels

[Texashiker]

Is it possible to route traffic through a series of VPN tunnels? And without expensive routing equipment.

I am setting up a series site-to-site VPNs with 5 remote offices and 1 central office.

I thought about setting up a tunnel between the remote sites; so if a tunnel goes down, traffic could be routed to another remote office, then to the main office.

Lets say the VPN between office A and the main office goes down, then the traffic would be sent to office B, then to the main office.

A tunnel is established between 2 of the remote offices, but the firewalls are not routing traffic if one VPN goes down.

The main firewall is a Cisco SRP547W-A-K9, 2 of the remote firewalls are Zyxel VFG6005N, 2 are watchgaurd X5, and one Linksys RV042.

 

[spidey07]

It's pretty straight forward. Each spoke site would have two routes for the far end network, but one with a higher cost. If the next hop (the tunnel) to hub is down the higher cost one would be used.

 

[dawks]

Hak5 shows how to do it with proxies, here, which wont help you entirely, but good to know anyway.

 

[drebo]

The most common cause of a tunnel going down is Internet going down...at which point ALL of the tunnels will go down anyway.

Even so, it would be an extremely high maintenance configuration.

Recommend: DMVPN.

 

[Lithium381]

The most common cause of a tunnel going down is Internet going down...at which point ALL of the tunnels will go down anyway.

Even so, it would be an extremely high maintenance configuration.

Recommend: DMVPN.

Hah, he listed his hardware . . . DMVPN isn't possible with what he's running.. at least not the cisco solution . . . are there other implementations from other vendors?

 

[drebo]

Hah, he listed his hardware . . . DMVPN isn't possible with what he's running.. at least not the cisco solution . . . are there other implementations from other vendors?

Not that I know of, no. Several vendors do support multipoint GRE, though. Still requires a mesh of IPsec to do it securely, but at least it's easier to route over.

With his equipment, he's pretty much SOL.

 

[ch33zw1z]

Not that I know of, no. Several vendors do support multipoint GRE, though. Still requires a mesh of IPsec to do it securely, but at least it's easier to route over.

With his equipment, he's pretty much SOL.

I'm no expert, but he was told this in another thread. You get what you pay for. You want a high-availability solution, you pay for a high-availability solution.