How redundant VPN

Similar Questions

• Redundant VPN design

  Hi all

  I need a solution for this implementation:

  2 sites

  2 internet connections each site (different suppliers)

  1 ASA in each site

  I need a config that allows me to have redundant VPN connections from one site to the other. I need to have a VPN using the, say, internet connection A of site 1 and internet connection from site 2 and if the internet connection A of site 1 goes down the VPN connect by using the internet connection B from site 1 to site 2 A internet connection. This must be done without user intervention.

  If I can't do it with the ASA which can use to achieve this scenario? Another router (2900), a kind of load balancing?

  I would like to use the ASA because I have a lot of inbound NAT configured and keeping addresses public IP on the SAA outside interface would be great.

  Thank you, best regards.

  Yes.

  You can apply the same card encryption on both interfaces.

  Also... If you have multiple VPN peers, they end on the same card encryption as well.

  If you for example need many VPN Site to Site tunnels, you create a single card encryption with sequence numbers different to accept VPN connections.

  Federico.

• Recovery site - redundant VPN peers

  Hello all, thank you in advance for your expertise.

  We put in place a recovery site disaster that will host the redundant copies of our servers and critical data in Kansas City.  When disaster strikes, our headquarters site would be totally gone.

  We currently have 7 locations that communicate to our HQ via VPN tunnels (whether on a circuit of the Internet or on a circuit of Cox Communications Ethernet WAN).  Branch sites each can an ISR of Cisco 2821 router.  At Headquarters and on the DR site, we use a Cisco ASA 5510 to terminate VPN tunnels and do everything that our column spinal routing.  Routing on the ASA and branch routers is all static, using a routing protocol would be a nice update in the future... any ideas?  We use IPSEC VPN lan lan tunnels 2, no GRE/VPN is used because it is not terminated by the ASA.

  What is the best way to configure my routers for branch to automatically or manually failover to connect to one ASA different site of DR?

  In addition, if my seat is still in place, but either my Internet or Cox headquarters ethernet circuit breaks down.  How can I re - route all traffic in a loop to the seat on the right remains a circuit?

  Is there a better way to do what I want to accomplish?  BGP is not an option at this point due to its complexity.

  Lucas,

  To circumvent the two point separately.

  The best way to provide active / standby time of reundancy is preferred peer in cryptographic cards (on the ISR routers).

  You can choose to establish VPN to HQ and only if HQ is not aid you to DR, when HQ is you will EVENTUALLY return to it.

  The answer to share of your questions may also be the preferred option by peers (and several counterparts in a crypto map entry).

  This being said, you can try to send OSPF traffic to IPsec tunnel (and using the neighbor command to avoid the manipulation of mcast in pure IPsec).

  Docs:

  http://www.Cisco.com/en/us/docs/iOS/sec_secure_connectivity/configuration/guide/sec_ipsec_pref_peer_ps10591_TSD_Products_Configuration_Guide_Chapter.html

  HTH,

  Marcin

  P. S.

  If you want my personal opion, chaning ASAs in HQ and DR sites and put you in routers could make DMVPN or DVTI-ASIT scenario which gives you a lot more features ;-)

• Question of redundancy VPN l2l using 2811 as endpoint devices

  I have a new implementation of VPN L2L passes using two 2811 s than VPN terminal devices. I'll try to use the HSRP address between the public interfaces of both routers as VPN peer address. The problem that I found during the test is that the tunnel will become active and debugs watch the HSRP address as an invalid address to form the tunnel. Have a work-around, or a better plan for redundancy on peering address using similar devices? Thanks in advance.

  Take a look at this doc about IOS IPSec HA.

  http://www.Cisco.com/en/us/docs/iOS/security/configuration/guide/sec_vpn_ha_enhance_ps6922_TSD_Products_Configuration_Guide_Chapter.html#wp1039849

• Redundancy VPN by destination?

  Hi all, I am trying to set up a vpn for one of my clients. they must have the same tunnel vpn with same source - destination traffic but destined for two different periods of public inquiry. so this should have sort of a primary vpn if it don't then a secondary vpn must support. This isn't the redundant Internet access provider scenario.

  A network - B - vpn - terminate on X (most preffered)

  A network - B - vpn - terminate on Y (less preferred)

  On the ASA, you can do it with the primary encryption card with a higher priority than backup, but using the same ACL. If the first card cannot peer, the other will be implemented. It should be lower setting on the IPSec Security Association lifetime for this. You can also only defining the hub in single are created and the rays or receive only so that you do not have a RADIUS, creating a new SA when you do not want that it is for me.

• How Anyconnect VPN users will connect with cisco ASA, which uses the server (domain controller) Radius for authentication

  Hi team

  Hope you do well. !!!

  currently I am doing a project which consists in CISCO ASA-5545-X, RADIUS (domain controller) server for authentication. Here, I need to configure Anyconnect VPN and host checker in cisco asa.

  1 users will connect: user advanced browser on SSL VPN pop past username and password.

  2. (cisco ASA) authentication: VPN sends credentials to the RADIUS server.

  3 RADIUS server: authentication: receipt and SSL VPN (ASA) group.

  4 connectivity creation: If employee: PC so NAW verified compliance, no PC check Assign user to the appropriate role and give IP.

  This is my requirement, so someone please guide me how to set up step by step.

  1. how to set up the Radius Server?

  2. how to configure CISCO ASA?

  Thanks in advance.

  Hey Chick,

  Please consult the following page of installation as well as ASA Radius server. The ASA end there is frankly nothing much difference by doing this.

  http://www.4salesbyself.com/1configuring-RADIUS-authentication-for-webvp...

  Hope this helps

  Knockaert

• How backup VPN configuration between two universities?

  Hello, I am a student of the Greece and I have a graduation project to configure Backup VPN between two universities. Principal of communication made with leased lines. I study a lot, but now that it's time for implementation I have some thoughts:

  -What hardware and software IOS do I need? Cisco 1841 it is ok for A & D routers?

  -Use GRE IPSec transport mode or IPsec Tunnel mode?

  -What will be the failover mechanism for switching traffic lines leased to IP VPN Backup and opposite? A teacher told me something about the Interface Prioritys. I read somewhere that this is done with the such as EIGRP routing protocol. who was right the Professor or the book?  :-D

  -In the same place, they have Firewall and NAT, I need to do any action for this?

  The attached file contains topology I want to implement

  'My' talk site 1

  2 a Central Site

  E communicates with A, but no traffic is to A of E with normal circumstances. Subnet on E access Internet through F, then press D.    VPN will be implemented on the LAN but the specific source E traffic will pass through the Backdoor VPN (I think that the solution to this is ACL on the router). They have no routing protocol in 'my' site A directly connected routers and the default routes.

  How imlement this?

  I think the first thing to do is A to D connectivity

  I will try to do this to tracers package first, but how can ' I imitate the SP network?

  I need help I can get!

  Hi John,.

  In our scenario, given that our main connection is a direct leased line between E and F, so I guess there is no other network between the two routers. In this case we do not need to configure SLA monitoring or any interface a priority. We can simply enter two default routes:

  IP route

  IP route 254

  In this scenario, if the leased line interface goes down, the second default route is used and the traffic should be routed by A router.

  SLA monitoring monitors connection (using the ping tests) by one of the interfaces of the router, and when we are not able to ping from one server (specified in the configuration of the SLA) through the interface, then we change the default track to track traffic through some other interface.

  So, in your scenario, we can monitor the connection between E and F, and when the link goes down, we can change the default route to point a.

  This is useful in the scenario where we have another ISP connection as our primary connection.

  Here is a link on how to configure SLA monitoring on the router:

  http://www.Cisco.com/en/us/docs/iOS/12_4/ip_sla/configuration/guide/hsicmp.html

  After you have configured the SLA followed by using the link above, you can bind it to the default route by using the following command line:

  track road IP / / default main route

  IP route 255 / / default route with a metric of higer that comes into play when the main default route goes down

  In addition, the sample configuration that you give in the doc is almost correct, defined transformation is missing just a hashing algorithm. Here is a link with an example for a tunnel from lan-to-lan between two routers:

  http://www.Cisco.com/en/us/partner/products/HW/routers/ps221/products_configuration_example09186a008073e078.shtml

• How SSL VPN packages for two ASAs clustered licenses

  Hi all!

  If I have installed two Cisco ASA 5550 (ASA5550-BUN-K9) in failover mode, which I know support only 2 concurrent sessions of SSL VPN and you want to upgrade my boxes to support 15 AnyConnect SSL VPN sessions, how many licenses packages I need to buy?

  An ASA5500-SSL-25 for both boxes or two ASA5500-SSL-25 for one per box?

  Depends on what version of ASA you are running.

  If you are running version 8.3 and above, then you just buy 1 ASA5500-SSL-25 for a failover pair and it would work. If you buy 2 ASA5500-SSL-25, one license per box in failover pair, then the license gets grouped into 50 SSL user license.

  Here is the license information for ASA version 8.3 for failover pair:

  http://www.Cisco.com/en/us/docs/security/ASA/asa83/license_standalone/license_management/license.html#wp1315746

  For ASA running version 8.2 and below, you are required to buy 2 ASA5500-SSL-25 (one of each ASA in the failover pair) as the license should be exactly the same for the pair to failover to work, in the earlier version of the SAA.

  Hope that makes sense.

• How redundency for vmotion multiple vmkernels?

  Hello

  I have an equallogic SAN on a host of vSphere. The connection is set up as follows:

  vSwitch1

  *************************

  -Service 2 console

  -iSCSI4

  -iSCSI3

  -iSCSI2

  -iSCSI2

  -

  ---

  vmnic4

  -

  ---

  vmnic5

  **************************

  The iSCSI1... 4 VMK are each and every one is related to a NETWORK card (either 4 or 5). If I can activate only vmotion on a VMK, how to make redundancy?

  I guess that NIC dedicated for vmotion is an option (?), but that seems to be an ineffective approach...

  Hello Gheywood,

  In fact, devoting two cards (team) network for Vmotion redundancy is the best choice if possible. If you can't do that, then you should not put your VMotion traffic on the same NIC team as your iSCSI traffic. You have dedicated network cards / network (physically separated if possible) for iSCSI.

  If you combine a group of ports VMotion with another group of ports, the Service Console (or in the case of ESXi management network) is usually a good choice.

  Unless you use convergent network (CNAs) and 10 GbE adapters, this isn't uncommmon to see 10 NICs in an ESX host using the IP storage. I hope this helps.

  Don't forget to mark this "correct" answer or 'useful', if you found it useful (you'll also points).

  Kind regards

  Harley stagnate

  VCP3, VCP4

• Redundancy VPN

  I have a scenario where I have 2 ISPS connected to a different 800 router. Inside network is a single a (10.10.10.0/24). It is a single office and this unique office has a L2L tunnel with another office (office-2). How configure failover and load balancing, and always keep the tunnel if one ISP goes down?

  ciscobigcat,

  I just asked one of the experts switch that I worked with and he told me the 4500 s cannot handle GRE tunnel even if they are L3 switches.  So that would not work for you. 6500 or even the 3700 series switches should be able to do it without problem, but you should talk to your representative local sales to confirm.

  You can absolutely send a tunnel through another tunnel.  The concept is that build you a GRE tunnel between closure of the router behind the ASA closure on Router 1.  Then you build plain ipsec between routers-1 tunnel and the ASA that match all ip traffic between the closure on Router-1 for the closure of the router behind the ASA.

• Redundancy VPN configuration

  We have a VPN connection from site to site with a remote network and want to know if there is anyway to set a secondary IP address peer who would use VPNS to connect in case the primary became unavailable

  Configuration of counterpart of backup for tunnel vpn on the same crypto map

  Problem

  You want to use several counterparts backup for a single vpn tunnel.

  Solution

  Configuration of several counterparts is equivalent to provide a list of relief. For each tunnel, the security apparatus tried to negotiate with the first peer in the list.

  If this peer does not respond, the security apparatus made his way to the bottom of the list until a peer responds, or there is no peer more in the list.

  The SAA must have a card encryption already configured as the primary counterpart. The secondary counterpart could be added after the primary.

  This example configuration shows the primary counterpart as X.X.X.X and Y.Y.Y.Y as peer backup:

  ASA (config) #crypto map mymap 10 peer set X.X.X.X Y.Y.Y.Y

  http://www.Cisco.com/en/us/products/ps6120/products_tech_note09186a00807...

  HTH

  If useful rates

  Sent by Cisco Support technique iPhone App

• How can I use VPN to access my work files?

  Original title: VPN connection... then what?

  Our IT consultant gave me a procedure to set up a VPN between home and work.  I can establish a VPN connection now.  I can see the handshake of communication by the illustration.  All this is well and good, but how use VPN to access my work files?  In Logmein, I get a screen that remotes me to my work PC.  With VPN I get nothing.

  Hello

  Your question of Windows 7 is more complex than what is generally answered in the Microsoft Answers forums. It is better suited for the IT Pro TechNet public. Please post your question in the Technet Forum.

  http://social.technet.Microsoft.com/forums/Windows/en-us/home?Forum=w7itprogeneral

  I hope this helps.

• How the name of customization associated with its file in Anyconnect VPN?

  Here it is the Anyconnect VPN configuration. The customization uses a value - CBB. My question is how Anyconnect VPN define value - CBB. I found no where to define CBB in the configuration. The CBB file is in flash. If so, why I don't see the name of CBB associated configuration with the file located in flash. Thank you.

  --------------------------------------------
  CBB group policy internal
  CBB group-policy attributes
  WINS server no
  value of server DNS 172.16.1.1
  SSL VPN-tunnel-Protocol ikev2 client ssl clientless
  WebVPN
  value of the CBB URL-list
  AnyConnect ask to activate default webvpn timeout 30
  value of customization CBB

  BBC tunnel-group type remote access
  BBC-Global attributes tunnel-group
  address pool SSL_Pool1
  Group Policy - by default-CBB
  BBC webvpn-attributes tunnel-group
  customization CBB
  enable BBC Group-alias

  WebVPN customization objects are stored either in the / + CSCOU + / or / + CSCOE + / directory hidden for plaintext and encrypted items page respectively.

  They are managed through ASDM (Configuration > remote access VPN > clientless SSL VPN access > Portal)

• Branch 5505, 1 circuit ISP, Dual - peer VPN Configuration for Data Center & Track Options

  Hi all

  I have a data center with two lines of ISP redundancy and two ASA 5520 for redundancy VPN to my branches.  Each of my branches has 1 ASA 5505 with a base license and 1 ISP circuit. Currently all my VPN tunnels are built for data center main circuit ISP only, so if one goes down, I'm toast.  I need to fix this. Problem is, I don't know how I can control failover on 5505 with 1 single line branch.  Please see my picture for an example of how he looks at it right now.

  So the problem is that the data center LAN my branch has to go to is identical regardless of which circuit of data center is in the. And I know the ASA rules say only 1 VPN tunnel can be active at a time if flow are the same.  So in this case, I know you usually do:

  card crypto outside_map 1 set 12.x.xxx.20 50.xxx.xx.190 counterpart

  and then configure route followed to control when cut down the primary counterpart and turn back up by peers. But where I have only 1 ISP on the side of the branch, I'll only have 1 default route: route outside 0.0.0.0 0.0.0.0 3.3.3.2 1, will be used that the active end counterpart is the primary or the secondary data center. Also, since I did not have a second track, I can't configure followed on the main road with an SLA that defines the trigger conditions, because there is nothing to ensure the follow-up of the routing.

  How is - a would handle a situation like this? Are there other features that can be taken off the roads?  I really need to be able to define "num-package 5 ' in ALS so my sites are not beat all day, but once again, without something to follow, I can't really set up a meaningful SLAS.  Any help is appreciated.

  Thanks for the additional explanation. It helps to clarify your environment. EIGRP running on the Remote would be a nice option, but I'm not sure that it is supported on the SAA. I ran EIGRP to remote peers using IOS routers (using the two ACCORD with IPsec and VTI tunnels tunnels) and it was very effective. But on the SAA, I believe that we must seek an alternative.

  It seems to me that using reverse road Injection as part of your VPN site-to-site should work. With IPP the ASA inserts a static route to remote resources when the VPN tunnel is negotiated and traffic can flow. If you redistribute the static in EIGRP EIGRP then must learn the ways of any ASA a currently active tunnel. And who should provide the dynamic rollover you need.

  HTH

  Rick

• VPN failover to WAN, test

  Hello

  I had a previous post on this topic. After receipt of the resolution of the data center has added a new problem to my test plan.

  The purpose of this test VPN is ping on a real server, VPN tunnel through, without the possibility of remoest cause a crash.

  I have a switch 3750 L3 behind my firewall, and the default gateway is the firewall. I want to create an ip address of loopback on this unit for purposes of test for the VPN tunnel. I then will source a ping since the closure to the Ip address of the server to my remote data center. My EUGHEA links do not pass through the firewall.

  By the data center, they have routing configuration that all /10.0.0.0/8 address 192.168.0.0/16/ will be forwarded to their WAN EUGHEA affair. The States of data center

  I need to create a unique ip address to stock up the pings of the kind he will return the their Checkpoint fw, then the tunnel between us.

  I think the loopback address might look like this 100.255.255.1/32

  If I ping the ip address of server of the L3 switch with the loopback source address, it shuts down my WAN EUGHEA link because that's how routing is configured.

  The question is how can I hide the destination server, IP address so that the ping does not take the EUGHEA path but borrows the fw, then the tunnel?

  My thought is a 1-to-1 nat in the firewall of the server to DC.

  static (inside, outside) (Server natted ip) (the current server IP) subnet mask 255.255.255.255

  I then add this 'ip address of the server natted' VPN policy to the REMOTE NETWORK.

  natted ip address must also be an IP outside the 192.168.0.0/10.0.0. scopes

  This server natted ip address would be 100.255.254.1

  Then I could ping the loopback source. natted ip address

  A question I have is the remote data center will have to reverse nat on their end to allow the ping to reach the correct destination?

  Advice of experts for this very important issue.
  

  Hello

  You speak of a firewall and L3 switch configuration. You also talk EUGHEA which I do not know what that means? You just talk to a separate VPN device? A simple network diagram could clear the configuration for a lot of people reading this post.

  If I understand the installation program, then you have a link dedicated between your site and data center site. And you want to add is that there is a path between these networks over a VPN L2L connection also.

  But if that's the case I still don't know how this VPN L2L would be used between the sites.

  If you really want to get a redundancy between the 2 sites, it would be better if you can run that a dynamic routing between each connection protocol and that looks like the L3 device at each end through which link/connection, they should reach the other site.

  In this configuration it seems to me that you'd have to hide the IP addresses of the two network in order to use the VPN at the same time, while the real dedicated connection is in use.

  -Jouni