?
Solved

Cisco 2811 - IPSEC High Availability and Stateful Failover

Posted on 2006-11-27
3
Medium Priority
?
1,916 Views
Last Modified: 2007-12-19
All,

I have a pair of Cisco 2811 routers running Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(3c), RELEASE SOFTWARE (fc1).

I have a number of IPSEC VPNs running to one of these routers, and I now want to bring the second router into a failover configuration.

Using info from Cisco config guides and an IPSec VPN Design book I have done something along the following lines.

Router A
======

interface FastEthernet0/0
 description Outside
 ip address 192.168.0.1 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 standby 1 priority 100
 standby 1 ip 192.168.0.100
 standby 1 preempt
 standby 1 name Out-VIP
 standby 1 track FastEthernet0/1
 crypto map vpnmap

interface FastEthernet0/1
 description Inside
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 standby 2 priority 100
 standby 2 ip 192.168.1.100
 standby 2 preempt
 standby 2 name In-VIP
 standby 2 track FastEthernet0/0

Router B
======

interface FastEthernet0/0
 description Outside
 ip address 192.168.0.2 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 standby 1 priority 150
 standby 1 ip 192.168.0.100
 standby 1 preempt
 standby 1 name Out-VIP
 standby 1 track FastEthernet0/1
 crypto map vpnmap

interface FastEthernet0/1
 description Inside
 ip address 192.168.1.2 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 standby 2 priority 150
 standby 2 ip 192.168.1.100
 standby 2 preempt
 standby 2 name In-VIP
 standby 2 track FastEthernet0/0


According to the info that I have I then need to configure ssp, but when I enter the following command :

ssp group 1

it's returned as an invalid command. Looking through the master command reference index I can't find an ssp command, so I guess it's now obsolete.

So my question is, first of all are the example commands above correct so far ? If not, what have I got wrong or missed out ? Secondly, what other commands are needed to ensure stateful IPSEC failover between my two routers ?

If you need any more information, please let me know.

TIA.


Rob
0
Comment
Question by:ccfcfc
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 1

Accepted Solution

by:
davidecooper1967 earned 2000 total points
ID: 18027134
These are the features I think you may be looking for:

IPSec VPN High Availability Enhancements

http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a00804dfa7d.html

AND

IOS IPsec High Availability (or Stateful Failover for IPSec)

http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00802d03f2.html

The first feature increases availability by using HSRP and RRI, and the second does much the same except that the SA's are communicated between the routers over an IPC channel, which gives you stateful failover. The first feature is available across a wide selection of routers and feature sets but the second is only available on a select number of routers (3700,3800,7200,etc).

Basically, if you want IPsec stateful failover you need may to get some 3700's or above unless something has changed recently.

I think SSP has been replaced with SSO...

DC
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

It happens many times that access list (ACL) have to be applied to outgoing router interface in order to limit some traffic.This article is about how to test ACL from the router which is not very intuitive for everyone. Below scenario shows simple s…
I have seen some questions on problems with SSH/telnet access to Cisco routers that may occur despite the fact that from a PC connected to your LAN, Internet connectivity is in place and users can access Internet sites without any issues.  There are…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

649 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question