GETVPN getting key server to participate in encryption

[pick25690]

Hi all,

Just working through configuring GETVPN which is pretty straightforward and group members have registered fine and are sending encrypted traffic to each other with no issues. 

I was wondering is there a way to get the keyserver to participate in the encryption kind of like a hub would in a DMVPN? The way I am planning it is that the keyserver will be DC router connected to the remote sites, I would need the traffic sent from the key server to be encrypted (data traffic using TEK). I have tried creating a crypto map and applying it to the interface on the keyserver but I just get the message failed to dertermine local IP address for group 1 on interface gig 1.  

Thanks,

Dan 

[Rob Ingram]

Hi,  A device acting as a KS cannot be configured as a GM, this is confirmed here (page 6).

HTH

[pick25690]

Thanks for the reply. Yeah certainly looks that way, I have read about something called KOOP Key Servers. Looks like this allows the KS to register as a member on the redundant group which would allow it to participate in the actual group encryption. Haven't actually tried this yet, will give it a blast tomorrow. 

http://blog.ine.com/2009/11/21/minimalistic-get-vpn-example/

[Rahul Govindan]

COOP is just a redundancy functionality between 2 KS. That means, both KS can be contacted by GM's to register. The author of that document has taken advantage of this functionality to register one KS to another and vice versa. However, this is not going to be officially supported to Cisco. Definitely test it out in a lab environment before using production devices for this kind of setup.