03-12-2014 08:23 AM - edited 02-21-2020 07:33 PM
What are the options for IOS Headend redundancy to support IKEv2 AnyConnect clients (terminating on ASR1k)? Currently, we use classic IKEv1 Remote Access VPN with the IPSec Client, and use stateless IPsec failover (using HSRP) between two ASR1k peers, and the failover, though not quick, is acceptable (clients need to detect the peer has gone away and reconnect.
Is something similar possible with IKEv2 RA VPN on a pair of ASR1k routers - I am not clear on what the headend certificate requirements are for IKEv2, as the FQDN in the client (and the certificate) points to a VIP which could be 'owned' by either router? Is the only solution a pre-defined list of backup peers (each with their own, separate, identity certificate).
I suspect the IKEv2 Load Balancer may offer an alternative solution, but again, the certificate requirements for the member servers isn't clear.
Cheers,
Matt
03-12-2014 10:11 AM
03-12-2014 11:02 AM
So, does that mean each member of the IKEv2 CLB cluster can have its own identity certificate (e.g. for the FQDNs vpn01.foo, vpn02.foo, vpn03.foo), and clients can connect to vpn.foo (which resolves to the VIP of the CLB cluster)? I thought there had to be a matching CN in the identity certificate of the VPN peer for the FQDN supplied by the AnyConnect client?
Or, should the trustpoint associated with identity certificate vpn.foo, once created, be imported into each VPN peer in the IKEv2 CLB cluster?
Cheers,
Matt
03-13-2014 02:05 AM
03-13-2014 04:52 AM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide