VPN ipsec on VRRP VIP

[tkachour]

Hello, 

I have 2 Cisco 1921 sharing a VRRP VIP and connected to a Fortigate like below : 

[Cisco]--|
               |---(ProviderNetwork)---[Fortigate]
[CIsco]--|

I would like to know if it's possible to set up a VPN ipsec between the fortigate and the VIP.

Did you experience such a network scenario before ? 

Thank you

[Karsten Iwen · Accepted solution]

Long time ago I implemented it with HSRP instead of VRRP:

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/17826-ipsec-feat.html

I'm not aware that it's also supported with VRRP. Today I would go a different approach:

• Configure two route-based VPNs (VTIs on IOS) from the FortiGate to the routers
• run a routing-protocol through the tunnel to achieve your redundancy

[tkachour]

Thank you for this answer. Could you please provide me with a reference document or some details about your suggested method ? 

[Florin Barhala]

Nice one - I met this HSRP IPSEC design before but never using it I forgot about it!

[Karsten Iwen]

Here are some resources on that:

• https://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_vpnips/configuration/15-2mt/sec-ipsec-virt-tunnl.html
• https://popravak.wordpress.com/2015/01/31/ikev2-between-ios-routers-svti-static-virtual-tunnel-interface/

[Mohammed al Baqari]

If you use VRRP/HSRP with crypto maps, configure VRRP group-name while
configuring it under interfaces. Then when assigning crypto-map to
interfaces use name keyword to map the VRRP group-name.

Exmaple

interface g0/0
crypto map CMAP name VRRP-Group

[tkachour]

Thank you but the VRRP group-name configuration is not possible in the router i'm working on. That's only possible for HSRP.