VPN3k Load-Balancing and IOS IPSEC Stateful Failover

[m.laporta]

Hi Experts.

As I need to design a highly-resilient Cisco-based hub-and-spoke IPSec VPN with several sites, I'm wondering what's the difference between the following two mechanisms:

- VPN 3k Load-balancing

- IOS IPSEC Stateful Failover

As far as I understand, VPN 3k Load-balancing implements an active-active configuration but is not transparent to the remote IPSec termination, so it supports only the Cisco VPN3002 and the Cisco VPN Client on the other side.

On the other hand, the IOS IPSec Stateful Failover implements an active-standby configuration but seems to be more transparent to the remote IPSec termination and can support every equipment to the other side.

Am I correct?

Your comments are welcome.

Thank you

michele

[tohuang]

Hi Michele,

What you said is right. When you are doing IOS IPSEC stateful failover, the remote site has no idea you are doing failover and it can support more equipment.

Anyway, you are correct about VPN 3K and IOS IPSEC.

Thanks

Tony