3015 Concentrator Active - Standby problems

[cybrsage]

I have two 3015 concentrators in active-standby setup. They have worked without a fault for many years. A recent lightning strike killed one of them, and I cried.

The new one from Cisco is different than the old one.

OLD: Single power supply, 128 MB RAM, bootcode 2.5, software 3.6.1

NEW: Two power supplies, 256 MB RAM, not sure of bootcode and software revs, but the machine is brand new from Cisco, so they should be recent ones.

I tried to setup Active-Standby on them, with the new one as the standby. It actually went into Active-Active without the ability to fail over if one was turned off.

Do the two Concentrators have to be identical (memory, power supplies, bootcode, software rev) to work together?

[sachinraja]

hello

as far as i know, they should be of identical hardware. i had used vpn 3030's in failover mode, and they had identical hardware. i was able to use it without any issues. though, iam not able to find any docs which says this...

Raj

[ajagadee]

Michael,

You could use different types of VPN3000 to do active-standby (VRRP).

Eventhough its not recommended, you can configure VRRP using a VPN3015 and VPN3030 and it should work fine. The reason its not recommended is simple. In case if you use a VPN3030 as the master and it fails, the VPN3015 should be able to handle all the connections.

In your case,

1. Make sure the configuration is correct

2. Both the chassis have the same number of interfaces.

3. And upgrade/downgrade code on the VPN3015 and try to match them. Hopefully, this should fix your issue.

I hope it helps.

Regards,

Arul

[cybrsage]

I will be downgrading the newer concentrator tomorrow afternoon and will post what happens.

Thanks to everyone who relied!

[cybrsage]

New situation:

Turns out one of the concentrators is actually a 3030 with 512 MB RAM. The other is a 3015 with 128 MB RAM.

When I setup the 3030 for vrrp using 3.6.1 code, it immediately gives me the following error:

VRRP Associated IP Address Mismatch

for every interface. It is the ONLY concentrator on the test network.

What am I doing wrong?

[ajagadee · Accepted solution]

Michael,

Is the VPN3000 Public and Private Interface plugged into the same switch. If so, are they on different VLANS. If not, can you configure the VPN Public and Private Interface to be on different VLANS.

If you still have some issues, please do post the VRRP Logs from the Concentrators.

I hope it helps.

Regards,

Arul

[cybrsage]

That did it. I did not realize VRRP used layer 2 notices. I made the assumption they used unicasts to the IP addresses entered...it was a bad assumption.

Thank you very much, and you deserve the points!