IPSec stateful advise needed

Unanswered Question
Nov 14th, 2008

I need advice from gurus in this forum who have experiences with this

scenario in a production environment:

I have a single VXR7206-a router running site-2-site VPN at my location A.

This VXR7206 router terminates about 20 other site-2-site tunnels. The

VPNs end-point at the remote location are Checkpoint firewalls, Juniper

firewalls, Nortel Contivity, Sonnic Wall, Pix/ASA and Cisco routers.

There are also several GRE/IPSec tunnels from this VXR7206 to other Cisco

routers at the other end. Everything is working fine so far. THERE


Now, I would like add another VXR7026-b on my end for automatically

redundant IPSec. In other words, if the VXR7206-a router goes down,

IPSec will automatically "stateful-failover" to VXR7206-b router, and

that isakmp does not have to be re-established.

Has anyone run into a similar situation like this and how do you go

about in making your VPN STATEFUL failover?

Many thanks.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)

Good question. I've tested "Stateful Failover for IPSec" 12.3(11)T feature on my 3825 routers (with built-in crypto accelerator disabled as it doesn't support it) and didn't like this feature.

It is topology and interface dependent. It is HSRP-based. The HSRP can run on a LAN (i.e. ethernet) only. It is difficult to configure in "transit" topology with two interfaces, because it requires HSRP state to be coordinated between the two interfaces (with mutual tracking). So, it was designed for the "on-a-stick" topology. It reboots the entire Active device at switchover when something goes wrong with it. It doesn't support load-balancing. It's a pure Active-Standby model. Some IPSec features may not be supported, but nobody can tell you which ones.

cisco24x7 Fri, 11/14/2008 - 11:58

I tested stateful IPSec in version 12.4

eight months and it was not a pleasant

experiences. IPSec stateful failover does

not support GRE, I don't think but I could be

wrong on this.

Any other suggestions? Thanks.


This Discussion