High Availability Site-to-Site IPSec VPNs

In this post we will describe high-availability for site-to-site IPSec VPN networks, Hot Standby Router Protocol (HSRP) is often used to track routers’ interface status to achieve failover between routers.

 

image

Here we define ISAKMP policy and IKE pre-shared key for IKE authentication, Note that 10.1.234.234 is the HSRP virtual IP address of the remote HSRP routers.

image

The trick here is with the IKE keepalive to detect the IPSec liveness of the remote VPN router. When HSRP failover happens, IKE keepalive will detect the HSRP router switchover.

Now on R3/R4 we can configure the following:

image

in here, we define HSRP under the interface. HSRP will track the internal interface. Now an HSRP group name must be  and will be used for IPSec configuration.  The “redundancy” keyword in the crypto map command specifies the HSRP group to which IPSec will be configured. 

if we test this configuration:

image

we get on R4 the following

image

Lets do R3 configuration now:

image

Now in This example we are going to demonstrate how HSRP and IPSec failover work together using the above setup and configuration, now in  normal operation,

image

and here we see that R3 is the Active router for HSRP.

image

now,

image

image

image

When failover occurs on the R3 the primary HSRP router, becomes a standby router. Existing ISAKMP and IPSec SAs are torn down. The R4 becomes active and establishes new IPSec SAs with R1.

image 

image

 

A Networker Blog

Advertisements

5 thoughts on “High Availability Site-to-Site IPSec VPNs

  1. Pingback: ip sla for tunnel tracking

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s