vpn with hssrp

[prashantrecon]

Hi

i have routers with hsrp

Vpn cannot be configured with virtual ip right ?

when the active router goes of standy by will become active.

shall i need to configure vpn on both routers.so what are the changes need to do at far end ?

What about the peer  ip that the far end needs to configure the vpn

[Giuseppe Larosa]

Hello Prashant,

using the HSRP VIP address as IPSec endpoint is supported.

Actually there is also a feature called stateful failover for IPSec that may be helpful. The feature adds the capability for the two routers to share information about the IPSec and IKE current SAs, to make switchover as smooth as possible.

It uses HSRP groups on the internal and on the external interface that have to be synchronized (the same router has to be the HSRP Active on both at the same time)

see

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t11/feature/guide/gt_topht.html

Hope to help

Giuseppe