Greeting Everyone!!
I'm trying to stimulate an environment where I've DC and DR locations and remote sites have to access DC/DR services.
For security, GETVPN is used. Initially tried using only one KS group (with R1,R2 and R12 in COOP) but apparently GM cannot communicate with KS over IPSEC because KS cannot be GM to itself.
So, tried with two groups wherein R1,R2 form Group-1(G1) and R12,R2 form Group-2 (G2). And each KS Group is a GM of other group i.e. R1 will act as KS for G1 and GM for G2, similarly R12=KS for G2 and GM for G1 & to ensure redundancy R2 will act as COOP for G1 and G2 both.
Now, the issue is if group-1 is given priority in GM-1 (in crypto map) then GM-1 can access G-2 member R12 but not
R1 and if Group-2 is given priority (in crypto map) in GM-2 then it can access R1 but not R12.
Is there any way to use crypto map gdoi based on the remote?
Ultimate aim to decrypt the traffic at ingress routers. What should I do ?? Please guide.
