VPN Concentrator and VRRP

8dstaicu · ‎10-03-2003

I have 2 VPN 3030 running VRRP.

It's very hard and difficult to keep both configurations up to date. It's very ease to forgot one click and an ipsec connection doesn't work in case of switchover. Keeping filters identical it's a nightmare. I have a config with certificates.

It is safe to copy config file from primary, replace ip addresses of the interfaces and copy it to the backup device. And reboot backup device after that?

gfullage · ‎10-05-2003

Yes it's safe to do this, provided you change the IP addresses in the config file everywhere. Be aware that they're not just on the interface, if you have OSPF and a few other options configured the IP addresses are listed under there as well. Make sure you do a global search for the IP address and change every occurrence otherwise you'll end up with weird things happening.

Other than that though, yes it is safe as I said, that's how I set up VRRP in the lab on two concentrators when I have to.

8dstaicu · ‎10-05-2003

i did it. But wasn't enought to change ip address. After reload of backup device (new config was used) i found that vrrp role was master. This parameter need to be changed too from master to backup1.

But I can't find in CONFIG file this parameter.

Did anybody knows where is it?