Solved

Cisco 2811 - IPSEC High Availability and Stateful Failover

Posted on 2006-11-27
3
1,862 Views
Last Modified: 2007-12-19
All,

I have a pair of Cisco 2811 routers running Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(3c), RELEASE SOFTWARE (fc1).

I have a number of IPSEC VPNs running to one of these routers, and I now want to bring the second router into a failover configuration.

Using info from Cisco config guides and an IPSec VPN Design book I have done something along the following lines.

Router A
======

interface FastEthernet0/0
 description Outside
 ip address 192.168.0.1 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 standby 1 priority 100
 standby 1 ip 192.168.0.100
 standby 1 preempt
 standby 1 name Out-VIP
 standby 1 track FastEthernet0/1
 crypto map vpnmap

interface FastEthernet0/1
 description Inside
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 standby 2 priority 100
 standby 2 ip 192.168.1.100
 standby 2 preempt
 standby 2 name In-VIP
 standby 2 track FastEthernet0/0

Router B
======

interface FastEthernet0/0
 description Outside
 ip address 192.168.0.2 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 standby 1 priority 150
 standby 1 ip 192.168.0.100
 standby 1 preempt
 standby 1 name Out-VIP
 standby 1 track FastEthernet0/1
 crypto map vpnmap

interface FastEthernet0/1
 description Inside
 ip address 192.168.1.2 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 standby 2 priority 150
 standby 2 ip 192.168.1.100
 standby 2 preempt
 standby 2 name In-VIP
 standby 2 track FastEthernet0/0


According to the info that I have I then need to configure ssp, but when I enter the following command :

ssp group 1

it's returned as an invalid command. Looking through the master command reference index I can't find an ssp command, so I guess it's now obsolete.

So my question is, first of all are the example commands above correct so far ? If not, what have I got wrong or missed out ? Secondly, what other commands are needed to ensure stateful IPSEC failover between my two routers ?

If you need any more information, please let me know.

TIA.


Rob
0
Comment
Question by:ccfcfc
3 Comments
 
LVL 1

Accepted Solution

by:
davidecooper1967 earned 500 total points
ID: 18027134
These are the features I think you may be looking for:

IPSec VPN High Availability Enhancements

http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a00804dfa7d.html

AND

IOS IPsec High Availability (or Stateful Failover for IPSec)

http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00802d03f2.html

The first feature increases availability by using HSRP and RRI, and the second does much the same except that the SA's are communicated between the routers over an IPC channel, which gives you stateful failover. The first feature is available across a wide selection of routers and feature sets but the second is only available on a select number of routers (3700,3800,7200,etc).

Basically, if you want IPsec stateful failover you need may to get some 3700's or above unless something has changed recently.

I think SSP has been replaced with SSO...

DC
0

Featured Post

Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Setting up a VPN 60 182
2 Gateways (bandwidth) - One domain 7 82
unable to set full duplex 100 on WAN interface 11 63
EIGRP Bandwidth 9 20
We've been using the Cisco/Linksys RV042 for years as: - an internet Gateway - a site-to-site VPN device - a leased line site-to-site subnet-to-subnet interface (And, here I'm assuming that any RV0xx behaves the same way as an RV042.  So that's …
Tired of waiting for your show or movie to load?  Are buffering issues a constant problem with your internet connection?  Check this article out to see if these simple adjustments are the solution for you.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

838 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question