Pix dynamic re-routing via backup peer

[mlj]

Is it possible to dynamically re-route via a backup peer2peer VPN to a different site (device) than the original peer in the event that the primary peer2peer VPN goes down?

Or does this mean changing the access-list / crypto map to a different peer manually in the event of a VPN failure.

the two remote sites have a backend network running dynamic routing protocols.

thanks in advance

[ehirsel]

You can code a 2nd peer address in the existing crypto map entry (at least with IOS and PIX), along with configuring isakmp keepalive to detect when one peer drops off. When interesting traffic happens, the ipsec sa's and isakmp sa's should get renegotiated between the new peers.

The newer cisco ios code, 12.3, has the ability to tie crypto maps to hsrp addresses too.

This will work as long as each peer has reachability to the other end.

[k.sato]

Hello,

Since I have similar quesion, please let me ask you further.

Does this mean, as long as 1st peer is up, 2nd peer will not be up?

If so, this could be exact solution for me.

[mlj]

Yes that is what I am looking for, both peers for me are a different locations.

[mlj]

Yes that is what I am looking for, both peers for me are a different locations.