MPLS (Cleartext) and Internet (IPSec VPN) Failover

[Chinmaya_Naik]

Dear Team,

Please find the below image.

Our requirement is to provide redundancy between MPLS and IPSec VPN.

Please suggest us any usecase so we can achive.

Thanks In Advanced

#Chinmaya Naik

[G_W_Albrecht]

Do you know this one here: sk56384: How To Create a Redundant, Service-based MPLS/Encrypted Link VPN ?

[Chinmaya_Naik]

Thanks Günther W. Albrecht‌ 

Yes i already go through this SK 56384 .

So is this working on our scenario.

#Chinmaya Naik

[Maarten_Sjouw]

When you have the possibility to have the MPLS routers to build a VPN over the internet to the other location, this would solve your problems. You would need to have a additional external IP on both FW's to be able to statically NAT those to the routers, only allow the routers access to each other and setup the external IP for the other router to route through the local FW to internet. This way both paths can be used and controlled by the router.

[Chinmaya_Naik]

Thanks Maarten Sjouw

‌I am not got your point.

Canyou please simplify. 

[Maarten_Sjouw]

Take your drawing and extend the VPN through the 1400 's and attach directly to the routers.  So let your routers build the VPN through the FW's and Internet. now you have the MPLS Path and the VPN path between the 2 routers, Routing will then need to be set that the MPLS is the better path and when that fails it will use the VPN path.

[Norbert_Bohusch]

It will work if all necessary routes for all networks are available on MPLS routers.

[G_W_Albrecht]

I have one problem - i do just not see any question here...

[PankajTiwari1]

I AM also facing same issue. according to SK 56384 it providing the load sharing and i just required high availability on MPLS (Clear Text) to IPSEC (Encrypted text). Please help me :).

[Sam2 · Accepted solution]

We use OSPF for this exact design. A high-level implementation would be:

1. Have your firewalls advertise a default route and have the MPLS routers advertise your internal networks for each office, be sure to change the metric of the default route advertisement so that one firewall doesn't take the internet for both offices
2. configure a VPN between the firewalls, route-based or domain based,  and either define routing for them or define their respective encryption domains 

If the MPLS fails the default route from the local firewall will be the only route in the office so traffic will go to the firewall and hit your vpn config

If the internet fails over the default route from the MPLS will come through and all office traffic will take the MPLS until the internet is restored 

[PankajTiwari1]

Dear SAM,

Thanks For your reply. i understand you are using Dynamic routing and i am using static routing. Please help me to provide the OSPF configuration senior so i can configure the same. Thanks:)

[Sam2]

I wont be able to supply config, you should reach out to a partner or checkpoint for help with an actual implementation if you are having problems so they could support any issues that arise