DMVPN and IPSec Stateful Failover?

Will IPSec Stateful Failover work with a DMVPN hub? If I have two 3845 with the proper AIMs, will this work?

Yes it is supported. It is supprted on VAM, VMA2, VAM2+.

Similar Messages

Ipsec Stateful Failover issue with Dynamic-Map

Hi all, I have an issue with a couple of Cisco ISR 2921 in Ha Ipsec Stateful Failover configuration.
With static crypto-map, stateful works good, Ipsec sessions are correctly trasmitted from Cisco Active router to Cisco Standby router.
With dynamic-map and profile, stateful fails, Ipsec sessions are not correctly trasmitted from Cisco Active router to Cisco Standby router.
I tried different IOS version:152-1.T3, 152-3.T2 and 153-1.T but I have the same behavior.
Could you help me?
Marco

Yes it is supported. It is supprted on VAM, VMA2, VAM2+.

Problem running DMVPN and IPSec VPN at the same time

I have a hub-spoke VPN network: 2 hub routers are 7206 VXR and remote routers are 2800. Each hub router has had number of point-to-point IPSec+GRE tunnels configured and running with remote sites. I'm now adding DMVPN between each hub router and a few other remote sites. The DMVPN is running fine between hub and spokes, but somehow it caused all the eixsting point-to-point IPSec tunnels drop. Here are some details:
1) Hub DMVPN config:
crypto isakmp key MYKEY address 12.12.12.12
crypto ipsec profile DMVPN
set transform-set DM
interface Tunnel1
ip address 192.168.1.1 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp map multicast dynamic
ip nhrp network-id 1
ip nhrp holdtime 600
tunnel source G0/0
tunnel mode gre multipoint
tunnel protection ipsec profile DMVPN
router eigrp 1
no passive-interface Tunnel1
2) Spoke DMVPN config:
crypto ipsec profile DMVPN
set transform-set DM
crypto isakmp key MYKEY address 14.14.14.14
interface Tunnel1
ip address 192.168.1.2 255.255.255.0
ip mtu 1400
ip nhrp map 192.168.1.1 14.14.14.14
ip nhrp map multicast 14.14.14.14
ip nhrp network-id 1
ip nhrp holdtime 600
ip nhrp nhs 192.168.1.1
tunnel source G0/0
tunnel destination 14.14.14.14
tunnel protection ipsec profile DMVPN
3) When DMVPN is up, hub router existing IPSec tunnels are shown ISAKMP failure.
Hub# show crypto isakmp sa
14.14.14.14 20.20.20.20 MM_NO_STATE 1508 0 ACTIVE (deleted)
4) After I shut down interface Tunnel1, existing IPSec tunnels are coming back. ISAKMP SA shows QM_IDLE state.
Have anyone seen similar issues between DMVPN and traditional point-to-point IPSec+GRE tunnels on the same router?
Thanks a lot

I have a hub-spoke VPN network: 2 hub routers are 7206 VXR and remote routers are 2800. Each hub router has had number of point-to-point IPSec+GRE tunnels configured and running with remote sites. I'm now adding DMVPN between each hub router and a few other remote sites. The DMVPN is running fine between hub and spokes, but somehow it caused all the eixsting point-to-point IPSec tunnels drop. Here are some details:
1) Hub DMVPN config:
crypto isakmp key MYKEY address 12.12.12.12
crypto ipsec profile DMVPN
set transform-set DM
interface Tunnel1
ip address 192.168.1.1 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp map multicast dynamic
ip nhrp network-id 1
ip nhrp holdtime 600
tunnel source G0/0
tunnel mode gre multipoint
tunnel protection ipsec profile DMVPN
router eigrp 1
no passive-interface Tunnel1
2) Spoke DMVPN config:
crypto ipsec profile DMVPN
set transform-set DM
crypto isakmp key MYKEY address 14.14.14.14
interface Tunnel1
ip address 192.168.1.2 255.255.255.0
ip mtu 1400
ip nhrp map 192.168.1.1 14.14.14.14
ip nhrp map multicast 14.14.14.14
ip nhrp network-id 1
ip nhrp holdtime 600
ip nhrp nhs 192.168.1.1
tunnel source G0/0
tunnel destination 14.14.14.14
tunnel protection ipsec profile DMVPN
3) When DMVPN is up, hub router existing IPSec tunnels are shown ISAKMP failure.
Hub# show crypto isakmp sa
14.14.14.14 20.20.20.20 MM_NO_STATE 1508 0 ACTIVE (deleted)
4) After I shut down interface Tunnel1, existing IPSec tunnels are coming back. ISAKMP SA shows QM_IDLE state.
Have anyone seen similar issues between DMVPN and traditional point-to-point IPSec+GRE tunnels on the same router?
Thanks a lot

IPSEC Stateful Failover using two 4507RE switches

Hello
I have been trying to find the configuration guides for a cat4500e-universalk9.SPA.03.04.00.SG.151-2.SG, with entservices license.
We have an immediate requirement to build a HA IPSEC VPN from two 4507RE switches, while we wait for new ASA's to be provisioned. I don't think we can do it, in HA setup.
Advice is very welcome.
Thanks
Nick

Nick,
IPsec is not supported at all on cat4500 platform.
We're working on removing IKE/IPsec commands from new parser in IOS XE:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCuh60386
M.
(Editted typos)
nicholas boran wrote: HelloI have been trying to find the configuration guides for a cat4500e-universalk9.SPA.03.04.00.SG.151-2.SG, with entservices license.We have an immediate requirement to build a HA IPSEC VPN from two 4507RE switches, while we wait for new ASA's to be provisioned. I don't think we can do it, in HA setup.Advice is very welcome.ThanksNick

Vrf aware dmvpn with ipsec profile breaks while enabling authentication in EIGRP named mode

Hi Friends,
I build a vrf aware dmvpn using IPSec profile and I got the DMVPN and IPSec crypto as UP and able to do advertise using EIGRP.
But the crypto and DMVPN breaks while I enabled the authentication in EIGRP named mode.
Once i remove the authentication, it works fine.
Any advice, how to solve this issue ? Any crypto commands need to add to make this work ?
Regards
Riyas Rasheed

Hi,
I attached the config I did, till I apply the authentication in EIGRP,
once I applied the below config, the dmvpn will break
""router eigrp EIGRP
add ipv4 autonom 45678
af-interface tu0
authentication mode hmac-sha256 KEY""
See any more configs I need to add in the crypto to make the dmvpn up.
Thanks

PO for LAN failover and stateful failover link?

Hi.. We have 2 x ASA 5520s running ver 9.0. We plan to aggregate the 2 interfaces used for LAN failover and stateful failover into a lacp PO. So both the ASAs are connected to each other directly using these 2 interfaces and then we logically make it a one PO. We then assign the PO intface an ip. Is this supported?

You can use any unused interface (physical, redundant, or EtherChannel) as the failover link. (Source)
That said, It would be an uncommon implementation. I almost always see them on separate physical interfaces.

CSS active-active stateful failover

Dear All,
May I confirm if CSS can do active-active stateful failover? If so, is it any restriction? and any Cisco URL I can refer to?
Thanks a lot.
mak

what do you call active-active ?
There different ways to achieve active-active.
What we can do is 1 vip active on 1 CSS-A and standby on CSS-B and a 2nd VIP active on CSS-B and standby on CSS-A.
But do you really need this ?
CSS can handle quite a huge amount of traffic so I never saw the need for active-active.
The failover can be statefull with CSS115xx not with CSS110xx or CSS118xx or CSS111xx.
Here is a sample config for one-armed mode but you can also have multiple vlans.
http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_configuration_example09186a00802206a3.shtml
Regards,
Gilles

Slow stateful failover for mission critical applications

I have two CSS running vip redundancy,ip interface redundancy and redundant-index on a ASR active-backup model.
They are attached to separate 3750 which share vlan info via a port channel.
When the master fails, we see the VRIR negotiation and mastership of VIPs occurs normally but the script that we run to validate our services fails and the services go to a down state.
Since the gateway for the reals is a redundant VIP that stays alive always based on a DUMMY service, we believe this could be a mac address table update on the 3750.
Traffic back from the reals is still sent to the "old" port where the gateway used to live.
Failover takes several minutes and TCP sessions timeout defeting stateful failover.
Any ideas???
Thanks
MANUEL

VLAN1 STP State: Disabled
VLAN1: Root Max Age: 6 Root Hello Time: 1 Root Fwd Delay: 4
Designated Root: 06-a4-00-11-93-90-61-78
Bridge ID: 06-a4-00-11-93-90-61-78
Root Port Desg
Port State Designated Bridge Designated Root Cost Cost Port
VLAN11 STP State: Disabled
VLAN11: Root Max Age: 6 Root Hello Time: 1 Root Fwd Delay: 4
Designated Root: 06-a4-00-11-93-90-61-79
Bridge ID: 06-a4-00-11-93-90-61-79
Root Port Desg
Port State Designated Bridge Designated Root Cost Cost Port
e1 Fwd 06-a4-00-11-93-90-61-79 06-a4-00-11-93-90-61-79 0 19 8001
VLAN211 STP State: Disabled
VLAN211: Root Max Age: 6 Root Hello Time: 1 Root Fwd Delay: 4
Designated Root: 06-a4-00-11-93-90-61-7a
Bridge ID: 06-a4-00-11-93-90-61-7a
Root Port Desg
Port State Designated Bridge Designated Root Cost Cost Port
VLAN222 STP State: Disabled
VLAN222: Root Max Age: 6 Root Hello Time: 1 Root Fwd Delay: 4
Designated Root: 06-a4-00-11-93-90-61-7b
Bridge ID: 06-a4-00-11-93-90-61-7b
Root Port Desg
Port State Designated Bridge Designated Root Cost Cost Port
e3 Fwd 06-a4-00-11-93-90-61-7b 06-a4-00-11-93-90-61-7b 0 19 8003

Is GSS do stateful failover

Hi,
Is GSS cabaple of doing stateful failover. Lets say if i have 2 ACE VIPs configured in GSS in Active-Standby mode. What will happen of existing connections in Active if it goes down?

Good morning,
The GSS is a DNS server, so it makes no sense to talk about connections on it.
In the setup you described, if the primary ACE VIP fails, the GSS will stop returning that VIP in the DNS replies and use the secondary instead.
What will happen to the connections on the ACE will depend on what made the VIP go down (and then we would be getting into the ACE topic), if for example the server went down, then, I'm afraid all connections will break. If however, just connectivity between the ACE and the GSS was lost, then, the connections will continue to work normally.
Regards
Daniel

Adding stateful failover to running configuration

Hi,
I have failover pair of ASA boxes without configuration of stateful failover. There is only basic LAN failover.
I want to add stateful failover configuration using dedicated interface of ASA. Is this with downtime zero when I will add command for stateful failover?
Thanks
Peter

As far as I know it won't affect traffic flow and there's not gonna be any downtime.

CSS 11051 Stateful Failover

We have received a note concerning stateful failover of the CSS series of products, where the CSS 110XX series doesn't support stateful failover, however the CSS 115XXX will. Here is the digest of the message;
On 3/6, Hosting Engineering and Operations issued an alert regarding the
CSS 11000 load balancer. This is an update to that alert.
Since that time, we have experienced another hardware failure of this
model device.
In response to this situation, the following has occured:
* Platform Engineeringis in the process of removing the CSS 11000
from the SOE. Itis on target to be removed in April.
* Operations hasre-inforced our escalation procedures with CISCO.
Qwest is to beissued a RMA immediately for this model.
* For newconfigurations including a CSS 11000, CCAR will require
an Individual CaseBasis (ICB) review and approval.
* For existing premiumand above customers whoes configurations
include a CSS 11000, HostingOperations is planning to replace them with
compatible device. These changes have been pre-approved by CCAR as long
as:
* the networktopology remains the same
* redundancy ispreserved
* CCAR gets notifiedof the replacement model so we can update our
records
* For existing basicand enhanced customers, we are drafting a
communique that alerts them tothe performance issues exerienced by Qwest
and providing suggestedalternative solutions.
In response to recent questions from the field.....
Stateful failover with redundant CSS 11000 Series Load Balancers:
The Bottom Line: Cisco CSS 11000 Series Load Balancers do not support
stateful
failover.
Will Cisco ever support this?: Yes, this is supported in the CSS 11500
Series,
known as Adaptive Session Redundancy (ASR)
I need this today, what can I do?: Choose an alternative product. The
F5 BIG-IP
load balancers support this functionality.
What is stateful failover anyhow?
Stateful failover is a technology that can maintain state information
between
the active load-balancer and the standby load-balancer. This state
information
can include: persistence mapping, telnet sessions, ftp sessions, tcp
session
state, etc...
Why should I be concerned?
Without state synchronization applications can break if there is a
failover from
the active to standby unit. FTP Sessions will be broken, Telnet
sessions will
be broken, and most importantly persistence state mapping will be lost.
What do I need to listen for to determine if stateful failover is
important?
1. E-commerce applications that require persistence mapping.
Persistence
mapping will keep a client session mapped to the same server for a
specified
amount of time. This is often important with shopping cart and other
e-commerce
applications.
2. Long-lived sessions. Whether they are planning to transfer large
files via
FTP or long-lived telnet sessions. Anytime a connection will be
required for a
long time and starting over is not an acceptable condition, then
stateful
failover is important.
Does this sound correct or is this a bunch of hot air?

Yes. Stateful failover, or ASR as it is sometimes called, is available on the CSS 11500 and Catalyst 6500 Content Switch Modules (CSM) load balancing platforms. It is not supported on the CSS 11000 due to architectural limitations of that platform.
Stateful failover is available on these Cisco platforms today.
mikep

CBAC Stateful Failover HA: ¿can it be used for three segments?

Hello team.
I need to protect three segments (inside, outside, DMZ) with two routers running CBAC and Stateful Failover High Availability.
I would like to know if the concept shown with two sample segments (inside, outside) in the documentation (http://www.cisco.com/en/US/prod/collateral/routers/ps5855/white_paper_c11_472858.html) can be extended for routers with three interfaces, each one attached to the segments I need to protect.
If this is a supported scenario, I would appreciate your pointing me to a sample configuration.
Thank you very much in advance.
Rogelio Alvez
Argentina

Rogelio,
Basicamente seria HSRP groups asi como el ASA usa el stateful link, el Router establece una asociacion con un IPC group que se configure por HSRP group:
Mira el siguiente link:
Step 6
ipc zone default
Example:
Router(config)# ipc zone default
Configures the interdevice communication protocol, Inter-Process Communication (IPC), and enters IPC zone configuration mode
Use this command to initiate the communication link between the active router and standby routers.
http://www.cisco.com/en/US/prod/collateral/routers/ps5855/white_paper_c11_472858.html
Si tienes alguna duda con mucho gusto.
Mike

I got my i phone4s few days back and i created an apple id with a credit card and when i go to the appstore to purchase apps,all have and message stating that "this app is no longer availabe"..how do i fix this issue?im from singapore by the way

i got my i phone4s few days back and i created an apple id with a credit card and when i go to the appstore to purchase apps,all have and message stating that "this app is no longer available"..how do i fix this issue?im from singapore by the way

If it is longer available then you can't get the app on your phone.

TS3694 I have recently done the update to my iphone and then tried to backup my iphone to itunes and an error meesage has occured and now my phone isn't responding to anything and is stating that it needs to be restored back to manufacturers settings, hel

I have recently done the update to my iphone and then tried to backup my iphone to itunes and an error meesage has occured and now my phone isn't responding to anything and is stating that it needs to be restored back to manufacturers settings, Can anyone help?

Hi d_diotte,
Thanks for using Apple Support Communities. If you're unable to update your iPhone and keep seeing the "Connect to iTunes" image, this article has some steps you can try:
iOS: Unable to update or restore
http://support.apple.com/kb/ht1808
Cheers,
- Ari

How to verify encryption (isakmp and ipsec) on VPN

Our customer believes the only way to verify data is being encrypted properly is to tap the fiber connections between our routers (encryptors). They are afraid that data might traverse the network that hasnt been encrypted.
I contend that using cisco show commands such as crypto session, crypto isakmp sa, and crypto ipsec sa validate VPN is setup correctly and providing data encryption.
Does anyone else have this scenario and any suggestions would be greatly appreciated on validating encryption.
Thank you.
Antonio

Hi Antonio,
you can use the following sh commands on asa to check the isakmp and ipsec details and encrypted networks
sh cry isa sa det
sh cry ipsec sa det
sh vpn-sessiondb det l2l
sh cry ipsec sa det peer
please refer the following link for router and asa commands
http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a00800949c5.shtml
once you know the packets are getting encrypted on the device you can run a capture on the outside interface of the VPN terminating decice and use wire shark to open the capture to do further analysis for encryption on the captured paccket.
refer the following doc to capture the packcet on FW
https://supportforums.cisco.com/docs/DOC-17345
Thanks and Regards,
ROHAN

DMVPN and IPSec Stateful Failover?

Similar Messages

Maybe you are looking for