How would you design redundant site-to-site IPsec between a branch and two data centers?
Show the answer
Say this first
Two route-based tunnels from the branch, one to each data center, ideally over two ISPs, each a VTI
with its own IKE and IPsec SAs. A routing protocol over both (BGP is the usual choice) makes failover
a routing decision. Prefer one path with local preference or metrics, detect failure fast with BFD
or tuned timers, and keep DPD on to clean up SAs. With crypto maps you only get several set peer
entries and DPD-driven failover, which is slower and harder to reason about.
Go deeper
Branch with two ISPs
- Tunnel1 sourced from the ISP A interface to DC1, Tunnel2 from the ISP B interface to DC2.
- Pin each tunnel's underlay to its ISP: a /32 static route to each headend via the matching ISP, or one front-door VRF per ISP.
Routing
- eBGP over the VTIs with private ASNs. Prefer DC1 with local preference on routes received from it, and make return traffic prefer DC1 too by prepending the AS path (or setting a higher MED) on what the branch advertises to DC2.
- BFD on the tunnel interfaces, where the platform supports it, gives sub-second detection. BGP timers alone take much longer.
- Watch for asymmetric routing through stateful firewalls in the data centers.
Same idea elsewhere
- DMVPN: two hubs, spokes with two NHS entries or two tunnels.
- Cloud: an AWS Site-to-Site VPN connection provides two tunnels to different endpoints; run BGP over both.
Prove it
Test failover and failback during a change window, and watch for traffic that keeps using stale SAs.
They will ask next
Why not rely on DPD alone?
DPD only informs the crypto layer and typically takes tens of seconds. Routing still points at the dead peer unless something withdraws the route. Routing over VTIs fails over in hold time, or in BFD time.
What is reverse route injection?
With crypto maps,
reverse-routeinstalls static routes for the remote proxy subnets while the SA is up, so they can be redistributed into the IGP. When the SA goes down the routes go too, and traffic moves to the backup path.
Traps
- Calling two tunnels over the same ISP and the same router redundant. Count the single points of failure.