GETVPN Questions

[pj_machado]

Hello to the community!

I know that the best design for a GETVPN architecture is with at least two KS, but due to a specific problem here at work, I will set up an infrastructure with only 1 KS.

The question is, when KS is unavailable, and GMs are unable to re-key, GMs just stop encrypting traffic, that is, the network continues to function without encryption capabilities; or the GMs stop sending all the traffic and this way the whole network goes down?

Thank you in advance

Paulo Machado

[balaji.bandi]

KS and GM are very key components in GETVPN - if this is a large network and it is suggested to have always dual for resilience purpose.

good explanation here for each role:

https://lostintransit.se/2016/02/12/ccde-introduction-to-get-vpn-and-get-vpn-design-considerations/

here is troubleshoot guide to help you :

https://www.cisco.com/c/en/us/support/docs/security/group-encrypted-transport-vpn/118125-technote-getvpn-00.html