Redundany WAN with PIX

[rasoftware]

I have PIX behind a router which was two public interfaces. PIX uses router as next hop and has a private address on the outside. The router has two wan interface, configured for redudancy.

Web browsing etc works great.

Problem is IPSEC behind the router isnt great. I have NAT-T enable and static NAT for 4500 etc.

Problem is PIX can be configured for multiple peers (ie backup WAN) but its very unreliable. I have added keep alives etc but its not really robust enough to deploy to customers.

Does anyone know a better way to provide WAN redundancy with a PIX?

[aacole]

You say your router is configured for redundancy with 2 WAN links, are these equal cost default routes, routes with different costs or a primary and standby type configuration?

If the links appear as equal cost paths then your IPSec traffic may be arriving out of order, which will give performance problems, that's one thought I had on reading this post. Or even arriving with differnet source addresses due to the NAT on the external router.

If you break one WAN link does your IPSec performance improve?

In a situation like this I'd prefer to use public addresses on the PIX to router link, remove the NAT from the external router and use routing (policy routing to push the IPSec down one link to prevent packet re-ordering problems.

[rasoftware]

Configuration is two WAN links. Arrangment is primary and backup. All traffic flow through primary. I use IP SLA to declare a route down and the other floating static kicks in via the backup. Both outside appear as two differnent IPs. This works great with www etc.

PIX sits behind the router with router as next hop and PIX is unaware of which route it takes.

I have configured remote PIX peers with both addresses. Under normal load PIX remote peers access the NAT'd pix via static port maps on UDP 4500 and 500. I also have static NAT on the backup interface. When the link fails over www traffic works great but IPSEC doesnt fail over very reliable. I see it building NAT translations on the router for the link thats down.

Normally PIX works ok behind NAT router, but it really doesnt work well with the failover interface, despite remote peers having this as an alternative endpoint.

Any ideas?