In order to conform to the basic principle of unambiguous IPsec rules, backup situations require VPN rules for the primary connection to be deleted first, and then new rules for the backup connection are created.
If the establishment of a backup connection fails, the backup module selects the next backup connection (if several are configured). If the next backup connection uses an ISDN connection, it is established completely normally, i.e.no IPsec rules need be reformulated.
If the backup at the main office is based on ISDN, it is important to avoid coupling the backup connection with the normal VPN connections to the other branch offices. In the event of a backup, these primary VPN connections carry not only the data traffic to the branch offices, but all traffic to the switching nodes and all other branch offices as well. This coupling can be prevented in two ways:
- A very high distance for the branch-office network is entered into the ISDN backup connection. This way the route can be overwritten by the routes automatically communicated via the VPN.
- Alternatively, the routes can be controlled using WAN RIP. For this, an ISDN connection with WAN RIP support is set up for every B-channel.
