cisco router - site to site vpn with 2 link and preemption

[secureIT]

Hi Team,

I have found the below for PIX/ASA firewall. But I have the same scenario with router.

In router, can we achieve preemption for VPN tunnel to fall back to primary link when it restores from a failure. ?

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

If you configured VPN with multiple peer IP addresses for a crypto entry, the VPN gets established with the backup peer IP once the primary peer goes down. However, once the primary peer comes back, the VPN does not preempt to the primary IP address. You must manually delete the existing SA in order to reinitiate the VPN negotiation to switch it over to the primary IP address. As the conclusion says, the VPN preempt is not supported in the site-to-site tunnel.

Taken from here:

http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/67912-pix2pix-vpn-pix70-asdm.html

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

regards

SecIT

[Marcin Latosiewicz]

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-s2.html#wp1966957785

"default" option on peer is what's typically used. 

In case of policy based VPN you rarely want to preempt due to need to re-establish IPsec SAs (which could cause interruption). 

On IOS it's much better to go for route based VPN and have routing protocol decide which peer/path should be taken. 

[Sanjay S N]

Hi Marcin, Even I'm facing the same issue. Could you please elaborate on the same.

[Marcin Latosiewicz]

I can try. What are your questions/doubts?

[Sanjay S N]

As you said if running policy based VPN, it means we have to re-establish the IPSec SA ? Is there any mechanism which we can implement to over come this ?

[Marcin Latosiewicz]

IKEv1/IPsec standard does not, or at least a couple of years ago it didn't, have a mechanism to check whether remote peer is available for negotiation  (not to say that OS cannot make certain decisions on behalf of IKE), i.e. you never know when IKE on the remote end is back up unless you try to send negotiation. 

A simple sla + track and EEM script will preempt those connections for you.

[Sanjay S N]

I have ip sla configured for tracking, but once primary link get stable the tunnel is not getting through the primary.

As said in the first blog, does it remains the same if VPN with multiple peer IP addresses for a crypto entry, VPN does not preempt to the primary IP address ??

[Marcin Latosiewicz]

Check FlexVPN's tracking capabilities if you don't want to do it via EEM.

Regarding preemption - read the command reference, of the config guide. But AFAIR there is no instantaneous preemption.