Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
1182
Views
0
Helpful
2
Replies

IPSec VPN tunnel failover using 'default' peer not failing back?

jasonhumes
Level 1
Level 1

‎11-12-2008 10:43 AM - edited ‎02-21-2020 04:01 PM

Hi

I've got IPSec VPN failover configured on my Cisco 871 router. I've got one crypto map with two peers configured, one set with the 'default' keyword with is the primary peer, the other only to be used if the first peer fails. I've enabled DPD every 60 seconds and this is able to detect the outage of the primary peer, clear the tunnel and re-establish to the backup peer. THe problem is that when the primary peer comes back, the VPN does not fail back over to it and proper communication stops working until I manually clear the tunnel. The remote side of this VPN tunnel has two seperate cisco 871 routers with two internet feeds from two different ISPs. I've tried to enable security-association idletime, but it doesn't seem to be working as the clients are still trying to send data through the tunnel, just not getting a response because they are sending through the tunnel to the backup peer and the remote hosts are responding via the primary peer. ANy help would be great. Thanks

Jason

1 person had this problem
Labels:
0 Helpful
2 Replies 2

Istvan_Rabai
Level 7
Level 7

‎11-12-2008 11:01 PM

Hi Jason,

As to myself, I would use GRE over IPSec for failover scenarios.

In this case both tunnels are up at the same time, and the routing protocol would decide about the failover.

You could configure the backup route to have a higher routing metric on both sides of the tunnels, so the backup tunnel is used only in case the other one fails.

This would provide a more reliable failover than traditional IPSec VPNs.

Cheers:

Istvan

0 Helpful

Eric Brown
Level 1
Level 1

‎12-30-2015 02:14 PM

Not sure if anyone will respond since this was an old post but I have a similar problem.

My lab router will fail over to the secondary peer but will not fail back to the default when it becomes available. I have the security-association idle-time 60 default in the crypto map but it never checks if the default peer is available. I have to clear the crypto session to force it back to the default peer.

I have the dead peer detection configured but it seems to only sense when the peer is dead but does not check to see if the default is alive to fail back to it.

Any one know why this will not fail back to the default as the documentation suggests it should?

0 Helpful
Customers Also Viewed These Support Documents