?
Solved

Cisco 2811 - IPSEC High Availability and Stateful Failover

Posted on 2006-11-27
3
Medium Priority
?
1,900 Views
Last Modified: 2007-12-19
All,

I have a pair of Cisco 2811 routers running Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(3c), RELEASE SOFTWARE (fc1).

I have a number of IPSEC VPNs running to one of these routers, and I now want to bring the second router into a failover configuration.

Using info from Cisco config guides and an IPSec VPN Design book I have done something along the following lines.

Router A
======

interface FastEthernet0/0
 description Outside
 ip address 192.168.0.1 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 standby 1 priority 100
 standby 1 ip 192.168.0.100
 standby 1 preempt
 standby 1 name Out-VIP
 standby 1 track FastEthernet0/1
 crypto map vpnmap

interface FastEthernet0/1
 description Inside
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 standby 2 priority 100
 standby 2 ip 192.168.1.100
 standby 2 preempt
 standby 2 name In-VIP
 standby 2 track FastEthernet0/0

Router B
======

interface FastEthernet0/0
 description Outside
 ip address 192.168.0.2 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 standby 1 priority 150
 standby 1 ip 192.168.0.100
 standby 1 preempt
 standby 1 name Out-VIP
 standby 1 track FastEthernet0/1
 crypto map vpnmap

interface FastEthernet0/1
 description Inside
 ip address 192.168.1.2 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 standby 2 priority 150
 standby 2 ip 192.168.1.100
 standby 2 preempt
 standby 2 name In-VIP
 standby 2 track FastEthernet0/0


According to the info that I have I then need to configure ssp, but when I enter the following command :

ssp group 1

it's returned as an invalid command. Looking through the master command reference index I can't find an ssp command, so I guess it's now obsolete.

So my question is, first of all are the example commands above correct so far ? If not, what have I got wrong or missed out ? Secondly, what other commands are needed to ensure stateful IPSEC failover between my two routers ?

If you need any more information, please let me know.

TIA.


Rob
0
Comment
Question by:ccfcfc
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 1

Accepted Solution

by:
davidecooper1967 earned 2000 total points
ID: 18027134
These are the features I think you may be looking for:

IPSec VPN High Availability Enhancements

http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a00804dfa7d.html

AND

IOS IPsec High Availability (or Stateful Failover for IPSec)

http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00802d03f2.html

The first feature increases availability by using HSRP and RRI, and the second does much the same except that the SA's are communicated between the routers over an IPC channel, which gives you stateful failover. The first feature is available across a wide selection of routers and feature sets but the second is only available on a select number of routers (3700,3800,7200,etc).

Basically, if you want IPsec stateful failover you need may to get some 3700's or above unless something has changed recently.

I think SSP has been replaced with SSO...

DC
0

Featured Post

Enroll in August's Course of the Month

August's CompTIA IT Fundamentals course includes 19 hours of basic computer principle modules and prepares you for the certification exam. It's free for Premium Members, Team Accounts, and Qualified Experts!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

While it is possible to put two routes in place with the secondary having a higher metric, this may not always work. In the event of a failure that does not bring down the physical interface on the router the primary route is not removed. There is a…
Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question