Solved

Cisco 2811 - IPSEC High Availability and Stateful Failover

Posted on 2006-11-27
3
1,835 Views
Last Modified: 2007-12-19
All,

I have a pair of Cisco 2811 routers running Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(3c), RELEASE SOFTWARE (fc1).

I have a number of IPSEC VPNs running to one of these routers, and I now want to bring the second router into a failover configuration.

Using info from Cisco config guides and an IPSec VPN Design book I have done something along the following lines.

Router A
======

interface FastEthernet0/0
 description Outside
 ip address 192.168.0.1 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 standby 1 priority 100
 standby 1 ip 192.168.0.100
 standby 1 preempt
 standby 1 name Out-VIP
 standby 1 track FastEthernet0/1
 crypto map vpnmap

interface FastEthernet0/1
 description Inside
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 standby 2 priority 100
 standby 2 ip 192.168.1.100
 standby 2 preempt
 standby 2 name In-VIP
 standby 2 track FastEthernet0/0

Router B
======

interface FastEthernet0/0
 description Outside
 ip address 192.168.0.2 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 standby 1 priority 150
 standby 1 ip 192.168.0.100
 standby 1 preempt
 standby 1 name Out-VIP
 standby 1 track FastEthernet0/1
 crypto map vpnmap

interface FastEthernet0/1
 description Inside
 ip address 192.168.1.2 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 standby 2 priority 150
 standby 2 ip 192.168.1.100
 standby 2 preempt
 standby 2 name In-VIP
 standby 2 track FastEthernet0/0


According to the info that I have I then need to configure ssp, but when I enter the following command :

ssp group 1

it's returned as an invalid command. Looking through the master command reference index I can't find an ssp command, so I guess it's now obsolete.

So my question is, first of all are the example commands above correct so far ? If not, what have I got wrong or missed out ? Secondly, what other commands are needed to ensure stateful IPSEC failover between my two routers ?

If you need any more information, please let me know.

TIA.


Rob
0
Comment
Question by:ccfcfc
3 Comments
 
LVL 1

Accepted Solution

by:
davidecooper1967 earned 500 total points
Comment Utility
These are the features I think you may be looking for:

IPSec VPN High Availability Enhancements

http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a00804dfa7d.html

AND

IOS IPsec High Availability (or Stateful Failover for IPSec)

http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00802d03f2.html

The first feature increases availability by using HSRP and RRI, and the second does much the same except that the SA's are communicated between the routers over an IPC channel, which gives you stateful failover. The first feature is available across a wide selection of routers and feature sets but the second is only available on a select number of routers (3700,3800,7200,etc).

Basically, if you want IPsec stateful failover you need may to get some 3700's or above unless something has changed recently.

I think SSP has been replaced with SSO...

DC
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

In a WLAN, anything you broadcast over the air can be intercepted.  By default a wireless network is wide open to all until security is configured. Even when security is configured information can still be intercepted! It is very important that you …
Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now