Failover MPLS WAN link to VPN Site to Site tunnel over Internet

[RetroGrade11]

First of all, I've tried searching, but didn't find much I could relate to. I'm also not an expert when it comes to routing. At our company we have an urgent need to setup site-to-site VPN over internet between our two locations to serve as a backup WAN link when the primary MPLS connection goes down. 

The connection from MPLS provider switch is connected directly to our HP Core Switch E8212zl at both locations. Our regular internet service provider router is connected to our MSR router sitting in front of the firewall, which then connects to Cisco ASA 5516-X firewall at both locations. The firewall then connects to HP Core Switch. We use OSPF for routing on our core switches at both locations. Everything works great with this setup. 

To allow uninterrupted access to network resources between both sites, I would like to setup VPN Site-to-Site connection over our regular Internet service provider line on the Cisco ASA firewalls, so that when the MPLS WAN link goes down, the Site-to-Site connection will failover to VPN tunnel that is established on the Cisco ASAs. 

I understand I have to setup VPN tunnel between the Cisco ASAs at both locations first, but once that's done, what would I have to do on the HP core switch to automatically re-route traffic to flow through the VPN tunnel as opposed to via MPLS circuit that is down? I would like this setup to be automatic, so when the MPLS circuit is back up, I would like to have the WAN traffic to failback to MPLS circuit. 

Attached is our current topology.

Thanks in advance.

[Mike_ES · Accepted solution]

Helo,

Please follow example: OSPF + floatic static route

http://howdoesinternetwork.com/2013/static-floating-route

Michal

[RetroGrade11]

Thanks Michal. I hope to give this a shot. I'll trye to post an update once implemented and tested.