ISCW10S04L05VPN HA.ppt

IPsec VPNs Cisco High Availability Options Failures IPsec VPNs can experience any one of a number of different types of failures: Access link failure Remote peer failure Device failure Path failure IPsec should be designed and implemented with redundancy and high-availability mechanisms to mitigate these failures. Redundancy Common solutions using one or more of these options: Two access links to mitigate access-link failures Multiple peers to mitigate peer failure Two local VPN devices to mitigate device failures Multiple independent paths to mitigate all path failures Failure Detection Native IPsec uses DPD to detect failures in the path and remote peer failure. Any form of GRE over IPsec typically uses a routing protocol to detect failures (hello mechanism). HSRP is typically used to detect failures of local devices. VRRP and GLBP have similar failure-detection functionality. Dead Peer Detection IKE keepalives: Keepalives in periodic intervals DPD: Keepalives in periodic intervals if no data transmitted On-demand option IPsec Backup Peer One HA design option is to use native IPsec and its HA mechanisms: DPD to detect failures Backup peers to take over new tunnels when primary peer becomes unavailable Configuration Example Router will first try primary peer. If primary peer is not available or becomes unavailable (DPD failure detection), the router tries backup peers in order as listed in the crypto map. Hot Standby Routing Protocol HSRP can be used at: Headend: Two head-end IPsec devices appear as one to remote peers Remote site: Two IPsec gateways appear as one to local devices Active HSRP device uses a virtual IP and MAC address. Standby HSRP device takes over virtual IP and MAC address when active HSRP device goes down. HSRP for Default Gateway at Remote Site All remote devices use virtual IP as default gateway. Backup router is only used when primary router is down. HSRP for Head-End IPsec Routers Remote sites peer with virtual IP address (HSRP) of the heade