IPSEC backup tunnel

[sundar.palaniappan]

Does Cisco's IPSEC solution support backup tunnel.

Here's the setup/requirment. Remote site has one Internet connection. There are 2 host sites - Site A & B. VPN tunnel between remote and host site A should be up always as long as there's interesting traffic. The tunnel between the remote site and host site B should only come up only if the primary tunnel goes down.

What solutions are available here.

TIA,

Sundar

[jackko]

yes, it doesn't support backup vpn. just wondering what sort of device has been deployed at the remote site.

e.g. for pix,

crypto map mymap 10 ipsec-isakmp

crypto map mymap 10 match address 101

crypto map mymap 10 set transform-set vpnset

crypto map mymap 10 set peer

crypto map mymap 10 set peer

for router,

crypto map mymap 10 ipsec-isakmp

match address 101

set transform-set vpnset

set peer

set peer

[sundar.palaniappan]

Thanks for the reply.

You mean to say, you could have multiple IPSEC peers, correct?

I did some further research on this and it's plausible, should the 1st peer become unavailable (can be detected using DPD) the router would try to form SA with the next peer in the list.

[jackko]

by configuring multiple peers on the router/pix, the list will be used as a backup list.

as you already know, should the first one on the list fails, the router/pix will then attempts to establish a vpn with the next peer on the list.

[diogo]

Hi guys, I have a very similar setup and am facing some issues with the backup peer.

What I have is a Host ASA ->Link Load Balancer > Remote Router

the remote router is configured with two peers. The first peers works great, SA is formed and traffic flows. When the first peer goes down, the remote router can reach the secondary peer but cannot form an SA.

Before blaming the loadbalancer for this I just wanted to hear you thoughts on other possible problems.

We are using pre-shared keys for auth. and they look good on both ends.

thanks in advance

Diogo

[a.alekseev]

pls, open another topic and attach configs, debugs... whatever you think will be helpful

Thanks