© 2006 Cisco Systems, Inc. All rights reserved.ISCW v IPsec VPNs Cisco High Availability Options

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v High Availability for Cisco IOS IPsec VPNs

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v Failures IPsec VPNs can experience any one of a number of different types of failures: –Access link failure –Remote peer failure –Device failure –Path failure IPsec should be designed and implemented with redundancy and high-availability mechanisms to mitigate these failures.

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v Redundancy Common solutions using one or more of these options: Two access links to mitigate access-link failures Multiple peers to mitigate peer failure Two local VPN devices to mitigate device failures Multiple independent paths to mitigate all path failures

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v Failure Detection Native IPsec uses DPD to detect failures in the path and remote peer failure. Any form of GRE over IPsec typically uses a routing protocol to detect failures (hello mechanism). HSRP is typically used to detect failures of local devices. VRRP and GLBP have similar failure-detection functionality.

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v Dead Peer Detection IKE keepalives: –Keepalives in periodic intervals DPD: –Keepalives in periodic intervals if no data transmitted –On-demand option

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v IPsec Backup Peer

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v IPsec Backup Peer One HA design option is to use native IPsec and its HA mechanisms: DPD to detect failures Backup peers to take over new tunnels when primary peer becomes unavailable

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v Configuration Example Router will first try primary peer. If primary peer is not available or becomes unavailable (DPD failure detection), the router tries backup peers in order as listed in the crypto map.

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v Hot Standby Routing Protocol

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v Hot Standby Routing Protocol HSRP can be used at: –Headend: Two head-end IPsec devices appear as one to remote peers –Remote site: Two IPsec gateways appear as one to local devices Active HSRP device uses a virtual IP and MAC address. Standby HSRP device takes over virtual IP and MAC address when active HSRP device goes down.

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v HSRP for Default Gateway at Remote Site All remote devices use virtual IP as default gateway. Backup router is only used when primary router is down.

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v HSRP for Head-End IPsec Routers Remote sites peer with virtual IP address (HSRP) of the headend. RRI or HSRP can be used on inside interface to ensure proper return path.

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v IPsec Stateful Failover

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v IPsec Stateful Failover IPsec VPNs using DPD, HSRP, or IGPs to mitigate failures only provide stateless failover. IPsec stateful failover requires: –Identical hardware and software configuration of IPsec on active and standby device –Exchange of IPsec state between active and standby device (i.e., complete SA information)

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v IPsec Stateful Failover (Cont.) IPsec stateful failover works in combination with HSRP and SSO. SSO is responsible to synchronize ISAKMP and IPsec SA database between HSRP active and standby routers. RRI is optionally used to inject the routes into the internal network.

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v IPsec Stateful Failover Example Configure IPC to exchange state information between head-end devices. Enable stateful redundancy.

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v Backing Up a WAN Connection with an IPsec VPN

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v Backing Up a WAN Connection with an IPsec VPN IPsec VPNs can be used as cost-effective and fast backups for an existing WAN. Switchover options: –Using an IGP (e.g., GRE over IPsec or VTI): Use IGP metrics to influence primary path selection Optionally, use HSRP to track PVC status on remote site –Using floating static routes for VPN destinations

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v Backing Up a WAN Connection with an IPsec VPN: Example Using GRE over IPsec IGP used to detect PVC failures Reroute to GRE over IPsec tunnel

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v Summary High availability requires two components: –Redundant device, links, or paths –High availability mechanisms to detect failures and reroute Native IPsec can be configured with backup peers in crypto maps in combination with DPD. HSRP can be used instead of backup peers. IPsec stateful failover can augment HSRP to minimize downtime upon head-end device failures. IPsec VPNs can be used as a backup for other types of networks.

© 2006 Cisco Systems, Inc. All rights reserved.ISCW v