Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

IPSEC backup tunnel

Does Cisco's IPSEC solution support backup tunnel.

Here's the setup/requirment. Remote site has one Internet connection. There are 2 host sites - Site A & B. VPN tunnel between remote and host site A should be up always as long as there's interesting traffic. The tunnel between the remote site and host site B should only come up only if the primary tunnel goes down.

What solutions are available here.

TIA,

Sundar

5 REPLIES
Gold

Re: IPSEC backup tunnel

yes, it doesn't support backup vpn. just wondering what sort of device has been deployed at the remote site.

e.g. for pix,

crypto map mymap 10 ipsec-isakmp

crypto map mymap 10 match address 101

crypto map mymap 10 set transform-set vpnset

crypto map mymap 10 set peer

crypto map mymap 10 set peer

for router,

crypto map mymap 10 ipsec-isakmp

match address 101

set transform-set vpnset

set peer

set peer

Re: IPSEC backup tunnel

Thanks for the reply.

You mean to say, you could have multiple IPSEC peers, correct?

I did some further research on this and it's plausible, should the 1st peer become unavailable (can be detected using DPD) the router would try to form SA with the next peer in the list.

Gold

Re: IPSEC backup tunnel

by configuring multiple peers on the router/pix, the list will be used as a backup list.

as you already know, should the first one on the list fails, the router/pix will then attempts to establish a vpn with the next peer on the list.

New Member

Re: IPSEC backup tunnel

Hi guys, I have a very similar setup and am facing some issues with the backup peer.

What I have is a Host ASA ->Link Load Balancer > Remote Router

the remote router is configured with two peers. The first peers works great, SA is formed and traffic flows. When the first peer goes down, the remote router can reach the secondary peer but cannot form an SA.

Before blaming the loadbalancer for this I just wanted to hear you thoughts on other possible problems.

We are using pre-shared keys for auth. and they look good on both ends.

thanks in advance

Diogo

Re: IPSEC backup tunnel

pls, open another topic and attach configs, debugs... whatever you think will be helpful

Thanks

526
Views
4
Helpful
5
Replies