Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cco
New Member

Multiple peers with the same crypto ACL

Hi,

Let's suppose that we have the following crypto map policy on a PIX firewall:

crypto map VPN-CRYPTO-MAP 10 match address L2L-TUNNEL-01

crypto map VPN-CRYPTO-MAP 10 set peer 1.1.1.1

crypto map VPN-CRYPTO-MAP 10 set transform-set ESP-3DES-MD5

crypto map VPN-CRYPTO-MAP 20 match address L2L-TUNNEL-01

crypto map VPN-CRYPTO-MAP 20 set peer 2.2.2.2

crypto map VPN-CRYPTO-MAP 20 set transform-set ESP-3DES-MD5

Please note that the ACL to be matched for both peers is the same. My question is: In case peer 1.1.1.1 fails, is the IPSEC tunnel going to be established with peer 2.2.2.2 instead for the same traffic?

Thanks in advance.

7 REPLIES
Hall of Fame Super Blue

Re: Multiple peers with the same crypto ACL

Hi

The simple anwser is i'm not sure without testing however could i ask what you are trying to achieve. If it is redundancy you can have multiple "set peer" statements under the same crypto map entry and it will try them in order.

Apologies if you already knew this.

Jon

cco
New Member

Re: Multiple peers with the same crypto ACL

Hi Jon,

Yes correct, I need peer 2.2.2.2 to act as backup only and being used in case 1.1.1.1 stops responding.

So you're saying that configuring the crypto-map as listed below will achieve that?

crypto map VPN-CRYPTO-MAP 10 match address L2L-TUNNEL-01

crypto map VPN-CRYPTO-MAP 10 set peer 1.1.1.1

crypto map VPN-CRYPTO-MAP 10 set peer 2.2.2.2

crypto map VPN-CRYPTO-MAP 10 set transform-set ESP-3DES-MD5

Thanks.

Hall of Fame Super Blue

Re: Multiple peers with the same crypto ACL

Hi

Yes that should do it.

Jon

cco
New Member

Re: Multiple peers with the same crypto ACL

Thanks Jon, I have one more question please. What happens if peer 1.1.1.1 gets back up? Is IKE going to try to renegotiate with it automatically?

Hall of Fame Super Blue

Re: Multiple peers with the same crypto ACL

Ahh well, to be honest i can't say for sure. I assume it will keep using 2.2.2.2 until the tunnel is torn down and it then tries to start it up again but without testing i'm not sure.

If i get the chance i'll knock this up in our lab but it's going to be a busy week so there might be a delay.

Jon

cco
New Member

Re: Multiple peers with the same crypto ACL

Well thanks Jon. If u get the chance to test it plz let me know :-)

Cheers

New Member

Re: Multiple peers with the same crypto ACL

Well it shoul dwork on 6.3. What is the solution for 7.2?

211
Views
4
Helpful
7
Replies
CreatePlease to create content