MPLS (Cleartext) and Internet (IPSec VPN) Failover

[Chinmaya_Naik]

Dear Team,

Please find the below image.

Our requirement is to provide redundancy between MPLS and IPSec VPN.

Please suggest us any usecase so we can achive.

Thanks In Advanced

#Chinmaya Naik

[G_W_Albrecht]

Do you know this one here: sk56384: How To Create a Redundant, Service-based MPLS/Encrypted Link VPN ?

[Chinmaya_Naik]

Thanks Günther W. Albrecht‌ 

Yes i already go through this SK 56384 .

So is this working on our scenario.

#Chinmaya Naik

[Maarten_Sjouw]

When you have the possibility to have the MPLS routers to build a VPN over the internet to the other location, this would solve your problems. You would need to have a additional external IP on both FW's to be able to statically NAT those to the routers, only allow the routers access to each other and setup the external IP for the other router to route through the local FW to internet. This way both paths can be used and controlled by the router.

[Chinmaya_Naik]

Thanks Maarten Sjouw

‌I am not got your point.

Canyou please simplify. 

[Maarten_Sjouw]

Take your drawing and extend the VPN through the 1400 's and attach directly to the routers.  So let your routers build the VPN through the FW's and Internet. now you have the MPLS Path and the VPN path between the 2 routers, Routing will then need to be set that the MPLS is the better path and when that fails it will use the VPN path.

[Norbert_Bohusch]

It will work if all necessary routes for all networks are available on MPLS routers.

[G_W_Albrecht]

I have one problem - i do just not see any question here...