topic Re: PIX IpSec VPN with "ip load-sharing per-packet" NxT1 in Network Security

PIX IpSec VPN with "ip load-sharing per-packet" NxT1

dmooreami — Mon, 11 Mar 2019 14:01:51 GMT

Looking to add another T1 to an exsiting 2600Xm router. We use IPSEC tunnels over the internet to connect offices.

Will using "ip load-sharing per-packet" interfere with the IPSEC Site-to-Site tunnel between my Pix 506e and other Pix's?

Is there something here on the Cisco site that states not to use "ip load-sharing per-packet" with IPSEC Tunnels?

thanks

Re: PIX IpSec VPN with "ip load-sharing per-packet" NxT1

alexandre.joanelli — Tue, 28 Oct 2008 19:13:04 GMT

I think that you will have no problem with that, once the splited ipsec sessions will be reassembled before reach the PIX through the router LAN interface.

Im not sure if an unordered flow os packets could originate some kind of problem, as errors or even performance issues.

Try use "per-session" to mitigate the impacts to the production environment.

Re: PIX IpSec VPN with "ip load-sharing per-packet" NxT1

dmooreami — Tue, 28 Oct 2008 20:25:54 GMT

TAC informed me that can't use T1 load sharing.

" Even if you're doing the load balancing on the routers and the IPsec endpoint is not the router itself, you'll have out-of-order packets due to the nature of load-sharing so the anti-replay feature will bring the tunnel down."

So solution is to go Multilink (mlpp).