Guys, i am facing some problem here i have 2 links in my headoffice from same ISP and got a fortigate, both Ipsec tunnels are working but problem is with my cisco when 2.2.2.78 is down which is primary the tunnel didnt switch automatically to secondary 1.1.1.51 i have 2 routes for 10.10.3.0/24 with different distance in fortigate. the actual problem is that when the primary link of HO goes down the branch router didnt switch to seconday HO link and the access list keep matching with the primary tunnel. If i remove access list from the primary tunnel then it works fine but i need automatic failover. Cisco 881 configuration is below, if you need addtional information let me know. Thank you ! track 101 ip sla 101 reachability ! ! crypto isakmp policy 10 encr 3des authentication pre-share group 2 lifetime 28800 crypto isakmp key test123 address 1.1.1.51 crypto isakmp key test456 address 2.2.2.78 crypto isakmp keepalive 10 periodic ! ! crypto ipsec transform-set my-set esp-3des esp-sha-hmac ! crypto map mymap 11 ipsec-isakmp match address 102 set peer 2.2.2.78 set security-association lifetime seconds 86400 set transform-set my-set crypto map mymap 12 ipsec-isakmp set peer 1.1.1.51 set security-association lifetime seconds 86400 set transform-set my-set match address 101 ! ! ! ! ! interface FastEthernet0 ! interface FastEthernet1 ! interface FastEthernet2 ! interface FastEthernet3 ! interface FastEthernet4 ip address 1.1.1.52 255.255.255.0 duplex auto speed auto crypto map mymap ! interface Vlan1 ip address 10.10.3.1 255.255.255.0 ! ip forward-protocol nd no ip http server no ip http secure-server ! ip route 0.0.0.0 0.0.0.0 1.1.1.9 track 101 ip route 0.0.0.0 0.0.0.0 1.1.1.51 200 ip route 2.2.2.78 255.255.255.255 1.1.1.9 ! ip sla 101 icmp-echo 2.2.2.78 source-interface FastEthernet4 timeout 500 threshold 499 frequency 3 ip sla schedule 101 life forever start-time now access-list 101 permit ip 10.10.3.0 0.0.0.255 any access-list 102 permit ip 10.10.3.0 0.0.0.255 any ! end
