Redundant routers with IPSEC failover

Question

For the failover between routers I plan to use HSRP:
####### Router 1 #######
interface FastEthernet0/0
ip address 151.4.0.21 255.255.255.0
standby 1 ip 151.4.0.20
standby 1 priority 120
standby 1 preempt
######## Router 2########
interface FastEthernet0/0
ip address 64.232.113.10 255.255.255.0
standby 1 ip 151.4.0.20
standby 1 priority 110
standby 1 preempt
Each router is connected to the internet via different ISPs. Router 1 has ISP A and router 2 has ISP B. I plan on using an IPSEC site-to-site VPN. How do I configure each router so when router 1 fails, router 2 will not only pick up all outgoing LAN traffic via HSRP, but also create the site-to-site VPN?

Answer 1

Hi,
Here are the guidelines for configuring the scenario which you described :
Configuring HSRP with IPsec
http://www.cisco.com/en/US/docs/ios/sec_secure_connectivity/configuration/guide/sec_vpn_ha_enhance_ps6441_TSD_Products_Configuration_Guide_Chapter.html#wp1056265
First you need to name the the HSRP group :
-> standby name group-name
e.g. standby name TEST
-> you define a on both devices a crypto map named e.g. called CRYMAP_TEST
-> then apply the crypto map on both devices (router1 and router2 ) to F0/0 :
    -> crypto map map-name redundancy [standby-name]
e.g. crypto map CRYMAP_TEST redundancy TEST
-> when defining the crypto peer setting on RemoteSite1 you define one peer only i.e.  151.4.0.20 (HSRP VIP)
So basically you will end up with a stateless IPSec High Availaibility setup.
Istvan