Simple IOS VPN IPsec HUB and Spoke with Failover HUB

[l.buschi]

Hi all,

I have a Hub nd Spoke  VPN architecture realized with sVTI, IKEv1 and IPsec.

My hub is connected to a single ISP.

I'd like to have an hardware redundancy for my hub.

Instead of creating a double tunnel in each spoke i'd like to use a failover protocol over my 4000ISR router.

Is there a way to realize it simply?

If I use IOS IPsec failover do I have to deploy my changes on  both router or (like ASA) I may configure the active router and let the standby receive the chenges?

Thank you all.

Johnny

[rvarelac]

Hi Johnny,

Which redundancy solution are you planning to implement on the Cisco ISR ? 

HSRP with another hardware box might fit well here:

http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-ipsec/white_paper_c11_472859.html

Hope it helps

-Randy-