Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Silver

IPSec stateful advise needed

I need advice from gurus in this forum who have experiences with this

scenario in a production environment:

I have a single VXR7206-a router running site-2-site VPN at my location A.

This VXR7206 router terminates about 20 other site-2-site tunnels. The

VPNs end-point at the remote location are Checkpoint firewalls, Juniper

firewalls, Nortel Contivity, Sonnic Wall, Pix/ASA and Cisco routers.

There are also several GRE/IPSec tunnels from this VXR7206 to other Cisco

routers at the other end. Everything is working fine so far. THERE

ARE NO NAT'ing ON THE VXR7206.

Now, I would like add another VXR7026-b on my end for automatically

redundant IPSec. In other words, if the VXR7206-a router goes down,

IPSec will automatically "stateful-failover" to VXR7206-b router, and

that isakmp does not have to be re-established.

Has anyone run into a similar situation like this and how do you go

about in making your VPN STATEFUL failover?

Many thanks.

2 REPLIES
ovt Bronze
Bronze

Re: IPSec stateful advise needed

Good question. I've tested "Stateful Failover for IPSec" 12.3(11)T feature on my 3825 routers (with built-in crypto accelerator disabled as it doesn't support it) and didn't like this feature.

It is topology and interface dependent. It is HSRP-based. The HSRP can run on a LAN (i.e. ethernet) only. It is difficult to configure in "transit" topology with two interfaces, because it requires HSRP state to be coordinated between the two interfaces (with mutual tracking). So, it was designed for the "on-a-stick" topology. It reboots the entire Active device at switchover when something goes wrong with it. It doesn't support load-balancing. It's a pure Active-Standby model. Some IPSec features may not be supported, but nobody can tell you which ones.

Silver

Re: IPSec stateful advise needed

I tested stateful IPSec in version 12.4

eight months and it was not a pleasant

experiences. IPSec stateful failover does

not support GRE, I don't think but I could be

wrong on this.

Any other suggestions? Thanks.

131
Views
0
Helpful
2
Replies
CreatePlease to create content