Redundant Site to Site VPN over OSPF

[jafrulla1986]

Dear Team,

Currently we have two Site to Site VPN Connections between HO (Cisco ASA 5515-X) and Branch office(Fortinet).

ISP 1(HO) Connected to ISP 1 (BO)

ISP 1(HO) Connected to ISP 2 (BO)

We need to achieve Redundant auto fail over of Site to Site VPN Connections and also we need to have Dynamic Routing Protocol (OSPF) over IPSEC tunnel.

Kindly provide a solution to achieve Redundant Site to Site VPN connections using Dynamic Routing Protocol.

[AndreaTornaghi]

Dear,

unfortunately ASA is not able to perform a GRE tunnel so it's not possible encapsulate OSPF protocol inside a IPSEC tunnel. For doing that you need to have a couple of router and configure a IPSEC over GRE tunnel.

In this case you will be able to manage OSPF protocol.

However with ASA you are able to manage a redundant IPSEC VPN. So you can have in one crypto map two remote peer (primary and backup).

In case that you are doing everything from scratch maybe take in consideration the DMVPN solution.