Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

IPSEC via redundant routes

I have a PIX behind a cisco router with two wan interfaces. PIX uses router as a default gateway. I have policy based routing on router and static routes out of each - 1 as backup for the other.

I have enabled PIX for NAT-T and all works ok over primary and secondary interfaces, with static NAT on router for UDP/500 and UDP/4500.

Problem is that it takes around 10 minutes for router to clear NAT table following the primary link going down. I can see in PIX logs that it can't fine peer etc.. until router NAT table has cleared (ie after 5mins). Add this to the time the SA renewal, say 10 mins, this results in a 10-15 minute fail over.

Cisco says this is the best method of IPSEC fail over, anyone got better idea or how to speed this process up?


Re: IPSEC via redundant routes


You could reduce the time by lowerin the timeout for NAT translations, which is 5 minutes for UDP per default, f.e. with

ip nat translation udp-timeout 60

The full command reference is found at

You might also try to adjust isakmp keepalive and "dead peer detection" to speed up SA negotiation.

Hope this helps! Please rate all posts.

Regards, Martin

New Member

Re: IPSEC via redundant routes

CreatePlease to create content