Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Attention: The Community will be in read-only mode on 12/14/2017 from 12:00 am pacific to 11:30 am.

During this time you will only be able to see content. Other interactions such as posting, replying to questions, or marking content as helpful will be disabled for few hours.

We apologize for the inconvenience while we perform important updates to the Community.

New Member

Feedback for VRRP failover wanted.

Getting ready to install a second 3030 concentrator for redundancy. Has anyone noted any issues with recovering lan-to-lan tunnels during failover? Any particulars that need to be checked such as ipsec lifetime for the SA? Do remote endpoints even see the failure / force to renogotiate, or does the secondary concentrator simply assume the connection. Any details of the process beyond the shared IP/MAC are appreciated as I can't take my primary out of production for more complete testing.

Thanks,

Mark

3 REPLIES
New Member

Re: Feedback for VRRP failover wanted.

Hi,

We have completed two installations with VPN3000`s VRRP. The following are issues with VPN3000`s VRRP design:

1. The failover is NOT transparent from the VPN Client. If the Master is down, the client has to disconnect and reconnect again. It means that the user has to click the disconnect button and click the connect button.

2. The CONFIG file has to be manually synchronized between the Master and the Standby device. There is no automate update of the CONFIG if you changes some parameters at the Master.

The above two issues are my main concern. Hopefully Cisco would address these issues. If anyone has other issues, kindly share here.

Regards,

Engel

New Member

Re: Feedback for VRRP failover wanted.

How about the LAN-to-LAN... any thing special there? According to the latest manual, it takes about 3 to 10 seconds to automatically switch over. However, I wonder if this is a statefull failover, keeping the TCP sessions alive while it switches?

--Chuck

New Member

Re: Feedback for VRRP failover wanted.

Chuck, the failover of these units worked very well in our situation. Keep in mind that they are not keeping a stateful layer 4 table like a PIX, only providing the end point for your tunnel. The need to establish new TCP sessions will depend on the hosts at each end and specific application resiliance to timing issues.

RFC 2338 explains the timing for VRRP failover.

Mark

214
Views
0
Helpful
3
Replies
CreatePlease to create content