IPSEC VPN

[Siddique]

Requirement : I want to create 2 ipsec VPN for fail-over / redundancy purpose on Router-A and Router-B. If the path through ISP-1 fail then traffic should automatically forward through ISP-2.

problem: I have successfully created ipsec VPN through ISP-1 network but cannot create VPN through ISP-2.

config file attached.

[MHM Cisco World]

crypto map crypto-map 10 ipsec-isakmp 
 set peer 20.0.0.2 40.0.0.2 <- two peer to protect same traffic 
 set transform-set myset 
 match address 100

Remove below 
crypto map crypto-map 20 ipsec-isakmp 
 set peer 40.0.0.2
 set transform-set myset 
 match address 100

Do same for other end 

MHM

[Siddique]

getting this error

[Siddique]

Is it ok?

[MHM Cisco World]

Ok

Check failover 

MHM

[Siddique]

site to site ping not successful through isp-2

[MHM Cisco World]

What you meaning ping is failed?

Set two peer under same map is use for failover' isp1 is down the two peer start use isp2.

It take some time to detect peer down

MHM

[M02@rt37]

Hello @Siddique 

Static routes on both routers are configured with equal AD of 1 (default value for static routes), which means they have equal priority. To achieve failover/redundancy, you should configure one static route with a lower AD than the other.

Router-A:

ip route 0.0.0.0 0.0.0.0 10.0.0.2

ip route 0.0.0.0 0.0.0.0 30.0.0.2 10

Router-B:

ip route 0.0.0.0 0.0.0.0 20.0.0.1

ip route 0.0.0.0 0.0.0.0 40.0.0.1 10

Traffic will prefer the route with the lower AD and switch to the backup route if the primary route becomes unavailable.

[Siddique]

Dear Sir,

Thanks for your reply. but still traffic not passing through isp-3 tunnel.

[M02@rt37]

@Siddique 

ISP 3 ?

[Siddique]

sorry not ISP-3, Its ISP-2.  

Now tunnel are ok. checking fail-over and let you know here sir.

[Siddique]

dear sir,

Fail-over not happining

[Siddique]

dear sir

fail-over not happining

[MHM Cisco World]

still not solve it ?????????

MHM