Solved

Cisco 2811 - IPSEC High Availability and Stateful Failover

Posted on 2006-11-27
3
1,847 Views
Last Modified: 2007-12-19
All,

I have a pair of Cisco 2811 routers running Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(3c), RELEASE SOFTWARE (fc1).

I have a number of IPSEC VPNs running to one of these routers, and I now want to bring the second router into a failover configuration.

Using info from Cisco config guides and an IPSec VPN Design book I have done something along the following lines.

Router A
======

interface FastEthernet0/0
 description Outside
 ip address 192.168.0.1 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 standby 1 priority 100
 standby 1 ip 192.168.0.100
 standby 1 preempt
 standby 1 name Out-VIP
 standby 1 track FastEthernet0/1
 crypto map vpnmap

interface FastEthernet0/1
 description Inside
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 standby 2 priority 100
 standby 2 ip 192.168.1.100
 standby 2 preempt
 standby 2 name In-VIP
 standby 2 track FastEthernet0/0

Router B
======

interface FastEthernet0/0
 description Outside
 ip address 192.168.0.2 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 standby 1 priority 150
 standby 1 ip 192.168.0.100
 standby 1 preempt
 standby 1 name Out-VIP
 standby 1 track FastEthernet0/1
 crypto map vpnmap

interface FastEthernet0/1
 description Inside
 ip address 192.168.1.2 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 standby 2 priority 150
 standby 2 ip 192.168.1.100
 standby 2 preempt
 standby 2 name In-VIP
 standby 2 track FastEthernet0/0


According to the info that I have I then need to configure ssp, but when I enter the following command :

ssp group 1

it's returned as an invalid command. Looking through the master command reference index I can't find an ssp command, so I guess it's now obsolete.

So my question is, first of all are the example commands above correct so far ? If not, what have I got wrong or missed out ? Secondly, what other commands are needed to ensure stateful IPSEC failover between my two routers ?

If you need any more information, please let me know.

TIA.


Rob
0
Comment
Question by:ccfcfc
3 Comments
 
LVL 1

Accepted Solution

by:
davidecooper1967 earned 500 total points
ID: 18027134
These are the features I think you may be looking for:

IPSec VPN High Availability Enhancements

http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a00804dfa7d.html

AND

IOS IPsec High Availability (or Stateful Failover for IPSec)

http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00802d03f2.html

The first feature increases availability by using HSRP and RRI, and the second does much the same except that the SA's are communicated between the routers over an IPC channel, which gives you stateful failover. The first feature is available across a wide selection of routers and feature sets but the second is only available on a select number of routers (3700,3800,7200,etc).

Basically, if you want IPsec stateful failover you need may to get some 3700's or above unless something has changed recently.

I think SSP has been replaced with SSO...

DC
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

New Server 172.16.200.2  was moved from behind Router R2 f0/1 to behind router R1 int f/01 and has now address 172.16.100.2. But we want users still to be able to connected to it by old IP. How to do it ? We can used destination NAT (DNAT).  In DNAT…
This article is a guide to configure bridging on Cisco Routers.  This is something I never knew was possible until after making a few phone calls to Cisco.  Using bridging saved our company money by not requiring us to purchase a new switch.  Bridgi…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now