Setting up failover in a V3 RV042

Similar Questions

• Several instructions set-peer - failover behavior

  Hi all

  I would like to confirm the behavior of the use of several instructions of the command "set-peer" under a single sequence of crypto-map for failover to IPSEC tunnel. In particular, what happens when a peer that has been previously unavailable returns to service?

  For example:

  I have two sites; Site 1 and Site 2 have two routers. All are connected by a routed cloud.

  Routers at each site have the following crypto card configured:

  Site1 - the two router A and router b:

  10 encryption ipsec-isakmp crypto map

  defined by peer RouterD
  defined peer RouterC

  Set transform-set 3desMd5
  match address 101

  Site2 - router-C and router D:

  10 encryption ipsec-isakmp crypto map
  defined peer RouterA

  defined peer RouterB

  Set transform-set 3desMd5
  match address 101

  HSRP is used on the side LAN between two routers on each site to prefer the router A and router C respectively as the active device.

  According to the Cisco documentation:

  "you can specify several counterparts by repeating this command (set-peer). The peer who has in fact, packets are sent to is determined by the last counterpart who heard the router (received traffic or a request for negotiation of) for a given stream. If the attempt fails and the first pair, Internet Key Exchange (IKE) tries the next peer on the crypto card list '.

  http://www.Cisco.com/en/us/docs/iOS/Security/command/reference/sec_s2.html#wp1046908

  If RouterA has an IPSEC tunnel to routerD... and router D fails, a tunnel is built between routerA and routerC. When the router D is backup... traffic switches to D from router to router A?

  What sequence of events would be the tunnel does not switch back once the main router has recovered from a failure?

  Thanks in advance.

  OK, that explains the behavior. When the router D returns, he becomes the main HSRP, traffic at the start of site 2 will use router D as point to exist; Router D paraphera session with A router ipsec. It looks like back switch for router D, but it's just because the initial D router to the router ipsec session has once he returns.

  HTH,

  Lei Tian

• Foglight | Configure the failover of database mirroring

  Hello

  How to set up failover for mirring database.

  I tried this configuration:

  My FMS application a database is xxx.xxx.xx.14 and mirring server is located in xxx.xx.xxx.16, and the witness server is xx.xxx.xxx.26

  and finally I changed the server configuration file in FMS (server.database.host = "xxx.xx.xxx.16" ;)

  After I tried to restart, but it didn't... Please help me solve this problem.

  What type of DB are you using?

  I suggest you to consult the guide to high availability

  It's the 5.6.10 version http://edocs.quest.com/foglight/5610/files/FoglightHighAvailability_Field.pdf

  Specifically to work with Oracle RAC, you have this info

  http://eDOCS.quest.com/Foglight/5610/doc/wwhelp/wwhimpl/common/HTML/frameset.htm?context=field&file=HA-field/CommonConfigs.2.php&single=true

  Golan

• Boring for pix failover message

  Hello

  >

  > I have two firewalls of PIX525 editing just with dynamic rollover and they

  > sewing to work properly except that I'm getting the message...

  >

  > Warning, lack of ip address or the inside interface failover

  >

  > The inside interface has an ip address and I don't want to use it for

  > failover, so why I get this message?

  >

  > I'm under 6.3.4

  Hello

  When you set up failover, you must assign each ip address, interfacean @,.

  When you assign an ip @ to a failover interface, the pix continues to display decreasing message. It assumes that there is an error.

  If you must give to each interface of your pix failover ip @.

  failover ip inside everything that...

  hope this helps.

• PIX 6.3 (4) failover strangeness with VLAN

  I have a failover pair 535 6.3 (4) running and have experienced strange things while he was trying to get the dynamic failover to work. We use the serial cable to failover and a GE dedicated to the traffic of State via a cable directly connected x. We have a mix of standard interfaces for non - VLAN'ed, but also a physical I / f including 10 ~ VLAN. We are well within the limits of i / f allowed on the PIX so that isn't a problem. Also the

  VLAN'ed i / f on the two firewalls connects via a 802. 1 q trunk on the same switch Procurve 9315. All the required them VLAN is configured as marked on the two ports on the switch.

  The problem we had was that all as-based interfaces on the VLAN and physics i / f associated with these virtual local networks were perpetually in the State (pending) and we had no stats in the status section of the command 'show fail', which implies to me that stateful failover did not in fact. Failover works and traffic passes regardless of which firewall is enabled.

  Based on things I've read that I concluded that the problem is probably that 'Hello' messages were not being seen on each VLAN. So I did a bunch of capture on the VLAN different i / f of the PIX expecting to see outgoing Hello in the local unit, but saw nothing. Then I had a thought that maybe they were sent out without a label on the physical I / f, so I made a capture on it and also got nothing else than to the Hellos coming out to the physical interface.

  What we did that fixed it was to add the VLAN physics to the list of allowed VLANS labeled on firewall connected switch ports. As if by magic the physics I / f to the Normal State, as did all the local VIRTUAL network interfaces, and we started to get statistics on the State of the output of the show fail command section.

  And yet a capture on any of the interfaces VLAN does still not show the Hellos, and a capture on the physical displays now the bidirectional Hello for the physical LAN. Weird.

  So my questions are:

  1 > why the VLAN interfaces are dependent on their physical I / f for failover. I was told that you need not have any IP or configured for physical integrity, nameif I / f it's just must be enabled for the VLAN I / fs to work.

  2 > how are the VLAN I / f passing Hellos to the other.

  I can include my config if that helps.

  Peter

  Peter,

  (1) why is a good question. AFAIK that is according to the doc (same link below)

  "When you set up failover for an interface VLAN, Hello packets are sent through the physical interface, so the physical interface must be configured with an ip address."

  (2) I don't think that they are:

  One of the guides

  http://www.Cisco.com/en/us/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a0080172786.html

  "Note that failover is supported with VIRTUAL local network interfaces. But the failover LAN interface command does not support VIRTUAL local network interfaces or failover link commands. "

  So basically it looks like helo packets are sent only on physical interfaces (dumped on any vlan you put them) and the VLAN will be "failover" If the pix, but if you had a failure in one vlan particular the pix would not notice it until the vlan the physical interface has been awarded to failed.

  Of course, it works in the equivalent level of the FWSM code - but FWSM never had the physical interfaces.

  The train 7.x supports subinterfaces, obviously.

  -Jason

  Please rate this message if it helps!

• TNS alias failover option

  Hi Experts,
  
  I'm getting "ORA-12170: TNS: connect Timeout occurred." frequently
  
  How to set up failover and backup earpiece these wait times for the listener of the backup
  
  
  Thanks in advance.

  If this is a random question, I'd enable tracing for your TNS connections as well as for your listener. Who can help find the reason when it comes to the top.

  HTH
  Aman...

• WRT160N & VPN IPSec

  I read a few other posts on similar problems, but none of the answers seem to solve my problem.  I have a WRT160N that the border to my home router, then I have a RV042 for a home office which is located behind the WRT160N.  If I reboot the WRT160N and then open the IPSec tunnel, it connects no problem but only for a few hours and then removes the tunnel.  When I try to reconnect the tunnel no VPN traffic can go out the next House, that seems.  When I look at the logs on the remote VPN router he did not see all of the trying to connect but when I look on the local RV042 it sends packets to connect.  Passage VPN has been activated on the WRT160N and I declined the MTU size to 1350 (as MTU seemed to be the cause of another person) but it doesn't seem to restore the tunnel.  The WRT160N also has the latest firmware (v1.02.2), any ideas of what could be the problem?  Or if there is a solution?

  Don't know how its working now, I passed only ports 500 and 4500 for the RV042 the WRT160N, deleted the static DHCP entry (but somehow the RV042 picks up again and still the same IP) and removed the DMZ for the RV042.  Also adjusted a few setting so that only that the RV042 behind the NAT aggressive game, also the RV042 behind the NAT router is set to authenticate using address dynamic IP and domain name while the main RV042 at the office is set to authenticate using the property intellectual property and domain name that is resolved by my ddns url.  Don't know if this can help someone, but in case it does...

• Recommendation of HW and advice on optimal configuration

  I have two requierments:

  1. Security
  2. Failover/redundancy

  Related information:

  1. 6 external links:
     1. 4 dsl to 4 different ISP (2 Mbit/s up/down)
     2. two point-to-point microwave links (up/down 15 Mbps)
  2. Public services:
     1. WebService, must be set to switch between 4 DSL
     2. X service, must be set to failover between two microwave links. (will consume 10 Mbps up/down)
  3. LAN related services:
     1. AD
     2. DNS
     3. etc...

  First impressions:

  1. SLA for the ISP trackign satisfy failovers
  2. HW failover between two devices from cisco for failures of hw.
  3. three different DMZ:
     1. WebService associated servers
     2. Service X associated servers
     3. Associate LAN servers
  4. Any ideas what so ever when it comes to security (ips, ids, etc...)

  Any recommendation or advice would be appreciated.

  You could probably accomplish what you want by using two devices.

  1. Security
     • Series ISA500
       • http://www.Cisco.com/Cisco/Web/solutions/Small_Business/products/security/ISA500/index.html
     • Size and capacity requirements will be determined based on the number of users/services behind the ISA and whether or not wireless is necessary.
     • With the total combined speed of approximately 38Mb, you should be well under the throughput Firewall 200 MB of the ISA550 and ISA550W max.
  2. Failover/redundancy for 6 links
     • RV016 - supports up to 7 links load balancing
       • http://www.Cisco.com/en/us/prod/collateral/routers/ps9923/ps9924/data_sheet_c78-501223.html
     • With the total combined speed of approximately 38Mb, you should be well under 200 MB NAT max flow.

  Basically set 6 connections on the RV016 and then attach the RV016 to ISA WAN1.  I would recommend to manage all your NAT/PAT on the ISA in this configuration.

  Shawn Eftink
  CCNA/CCDA

  Please note all useful messages and mark the correct answers to help others looking for solutions in the community.

• VPN connectivity lost after the regeneration of the keys (I think)

  Hello

  I have a L2L IPSEC tunnel between a set of failover pair of two ASA5510 and a unique ASA5505. Over time, they will lose connectivity through the tunnel. The tunnel itself remains standing, but can not pass any traffic.

  When you look at the tunnel I still see what is on the Board of 5510's (shown in bold @ IPSEC ID 3):

  advdns # sh vpn-sessiondb detail l2l filter ipaddress 93.160.2xx.1xx

  Session type: LAN-to-LAN detailed

  Link: 93.160.2xx.1xx
  Index: 14 IP Addr: K015-Peer
  Protocol: IPSecLAN2LAN encryption: 3DES
  Hash: SHA1
  TX Bytes: bytes 430820527 Rx: 9869311
  Connect time: 01:16:13 CEDT Monday, March 28, 2011
  Duration: 7 h: 46 m: 47 s
  Filter name: K015-L2L-filter

  IKE Sessions: 1
  IPSec sessions: 2

  IKE:
  Session ID: 1
  The UDP Src Port: 500 UDP Dst Port: 500
  IKE Neg Mode: Hand Auth Mode: preSharedKeys
  Encryption: 3DES hash: SHA1
  Generate a new key Int (T): 86400 seconds given to the key Left (T): 58390 seconds
  Group D/H: 2

  IPSec:
  Session ID: 2
  Local addr: HOST_RDC001/255.255.255.255/0/0
  Remote addr: 192.168.15.0/255.255.255.0/0/0
  Encryption: 3DES hash: SHA1
  Encapsulation: Tunnel
  Generate a new key Int (T): 28800 seconds given to the key Left (T): 25270 seconds
  Generate a new key Int (D): 413696 K-bytes given to the key Left (D): 413688 K-bytes
  TX Bytes: 24387 bytes Rx: 12754
  TX pkts: Rx 195 Pkts: 195

  IPSec:
  Session ID: 3
  Local addr: 10.30.15.0/255.255.255.0/0/0
  Remote addr: 192.168.15.0/255.255.255.0/0/0
  Encryption: 3DES hash: SHA1
  Encapsulation: Tunnel
  Generate a new key Int (T): 28800 seconds given to the key Left (T): 25715 seconds
  Generate a new key Int (D): 413696 K - bytes given to the key Left (D): 1 K-bytes
  TX Bytes: bytes 430796140 Rx: 9856557
  TX pkts: 385454 Pkts Rx: 207904

  This is the result of the order even at the end of the tunnel ASA5505:

  PFF # sh vpn-sessiondb detail l2l

  Session type: LAN-to-LAN detailed

  Link: 83.136.xx.xxx
  Index: 1 IP address: 83.136.xx.xxx
  Protocol: IPSecLAN2LAN encryption: 3DES
  Hash: SHA1
  TX Bytes: bytes 9869359 Rx: 430815282
  Connect time: 14:00:28 UTC Sunday, March 27, 2011
  Duration: 7 h: 47 m: 00s
  Name of the filter:

  IKE Sessions: 1
  IPSec sessions: 2

  IKE:
  Session ID: 1
  The UDP Src Port: 500 UDP Dst Port: 500
  IKE Neg Mode: Hand Auth Mode: preSharedKeys
  Encryption: 3DES hash: SHA1
  Generate a new key Int (T): 86400 seconds given to the key Left (T): 58381 seconds
  Group D/H: 2

  IPSec:
  Session ID: 2
  Local addr: 192.168.15.0/255.255.255.0/0/0
  Remote addr: 10.1.11.1/255.255.255.255/0/0
  Encryption: 3DES hash: SHA1
  Encapsulation: Tunnel
  Generate a new key Int (T): 28800 seconds given to the key Left (T): 25256 seconds
  Generate a new key Int (D): 4275000 K-bytes given to the key Left (D): 4274992 K-bytes
  Idle Time Out: 30 Minutes idling left: 29 Minutes
  TX Bytes: 12754 bytes Rx: 24387
  TX pkts: Rx 195 Pkts: 195

  IPSec:
  Session ID: 3
  Local addr: 192.168.15.0/255.255.255.0/0/0
  Remote addr: 10.30.15.0/255.255.255.0/0/0
  Encryption: 3DES hash: SHA1
  Encapsulation: Tunnel
  Generate a new key Int (T): 28800 seconds given to the key Left (T): 25701 seconds
  Generate a new key Int (D): 4275000 K-bytes given to the key Left (D): 3861311 K-bytes
  Idle Time Out: 30 Minutes idling left: 30 Minutes
  TX Bytes: bytes 9856605 Rx: 430790895
  TX pkts: 207905 Pkts Rx: 385265

  On the ASA5505 I can see the following in the log:

  March 27, 2011 21:21:17: % ASA-4-402120: IPSEC: received a package ESP (SPI = 0xBB2A21CF, sequence number = 0x1BB08) 83.136.xx.xxx (user = 83.136.xx.xxx) at 93.160.2xx.1xx, which has no authentication.
  March 27, 2011 21:26:12: % ASA-4-402120: IPSEC: received a package ESP (SPI = 0xBB2A21CF, sequence number = 0x2EF6E) 83.136.xx.xxx (user = 83.136.xx.xxx) at 93.160.2xx.1xx, which has no authentication.

  It has done this 4 - 5 times now, so I don't think it's a temporary problem. The ASA5505 has been restarted several times... 5510 failover restart is not an option. The 5510 holds currently more than 50 IPSEC tunnels, and it is the only features like this.

  If I make one counterpart of his clear cry ips 'The 5505 IP', then the tunnel's functional again.

  The SW version is:

  5510: 7.2. (4) 9

  5505: 7.2. (4)

  This is the setup I use for the tunnel:

  5510:

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  address for correspondence card crypto outside_map 15 K015-L2L-list
  outside_map 15 peer Peer-K015 crypto card game
  card crypto outside_map 15 game of transformation-ESP-3DES-SHA
  life safety association set card crypto outside_map 15 28800 seconds
  card crypto outside_map 15 set security-association life kilobytes 4608000
  outside_map interface card crypto outside
  crypto isakmp identity address
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400

  5505:

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  card crypto VPNMAP 10 corresponds to the address Hosting_List
  card crypto VPNMAP 10 set peer 83.136.xx.xxx
  10 VPNMAP transform-set ESP-3DES-SHA crypto card game
  VPNMAP interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400

  Anyone of you you have any good ideas?

  Best regards

  Jesper Ross

  I just checked and there are a number of bugs to generate a new key, ASA version 7.2.4 Please kindly pass the two ASA at least version 7.2.5.

  Here are the bugs for your reference:

  CSCtc47782 Invalid IKE traffic causes to generate a new key to fail:

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtc47782

  CSCso87442  ASA displays smaller traffic-volume lifetime than negotiated:

  http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCso87442
  
  CSCsq67954 ASA rekeys at less traffic volume than expected value:
  
  http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsq67954
  Prior to upgrade, you can just remove the following and see if it makes any difference:
  
  crypto map VPNMAP 10 set security-association lifetime kilobytes 4608000
  
  crypto map outside_map 15 set security-association lifetime kilobytes 4608000
  Clear tunnels on both end, and monitor to see if you are seeing the same issue.
  
  

• switch between 515 and 515E

  Hello

  I have a pix 515 with unrestricted v6.2 and a dmz interface, I want to get a foilover of 515E with 6 interfaces and v7 unit.

  is it possible to make the 515 and 515E work as failover after update the 515 to v7?

  Thank you

  to set up failover, the two units must be the same. which includes the model, the number of interfaces, os version and memory, etc.

  Thus, a pair of 515 and 515e is not possible to be deployed in active failover / standby.

• Advanced ESX vs. Enterprise (DRS)

  Hello

  I need help on the clarification of the ESX Adv. and Enterprise. I know that the Enterprise version comes with the additional function of "DRS" that allows as dynamic assignment from the pre-defined rule groups VM and the host/vCentre recommendations.

  However what I want to clarify is both have capacity HA, but assuming we buy 'Advanced' and when an ESX host fails the ESX HA feature will kick and the VMs system moved to another ESX host. If we use ESX Ent. then, the reallocation of the virtual machines based on pre-defined rules and usage on the host computer.

  But if I do not buy ESX Ent and use Adv rather is it possible for me to set the failover policy HA on virtual machines are transferred to what ESX host during a failover HA assuming I have 3 host ESX Adv.. ?

  Thank you very much

  One more thing to remember - if HA is more important to you than VMotion/DRS (and in my mind, it should be), it is available in all versions of vSphere license.  Even the least expensive option, vSphere Standard, includes HA.  You will still need to purchase vCenter to use the feature, however.

  If you have VMware DRS, and HA will work with DRS to place VMs on other host ESX intelligently based on the load.  But virtual machines are always going towards the down hard when ESX host crashes.  Another poster has already declared, HA and VMotion/DRS are completely different products with different use cases.

• 3i Embedded and vMotion

  How do people set up their Embedded 3i for NIC redundancy servers in a system of NETWORK 6 card?

  In the past, on traditional ESX I have configured as follows for not to consume more than half the NIC for management and VMotion.

  • Assign 2 network cards to vSwitch 0 (or Vswif0 in ESX), for arguments sake Let's say vmnic0 and vmnic3

  • Have 2 groups of VMKernel ports on vSwitch0, one for the service console (management in 3i connection) for VMotion.

  • I would then bypass the switch by default to be as follows:

  • Vmnic0 is the active NIC to the service console, vmnic3 is set to failover only

  • Vmnic3 is active for Vmotion NIC, vmnic0 is set to failover only

  This means that 2 network cards using the interface of the console/service management and Vmotion use their own NIC unless there is a problem with the NETWORK card, in which they would share a NETWORK card as long as the problem persists.

  To do it in a card system NETWORK 6 then leaves 4 network cards available for traffic of comments.

  However, when I tried to do in 3i I HAD to put in a gateway for the interface of Vmotion or HA would fail to set up with various errors such as cannot solve the other guests or is unable to ping address of default isolation.

  Now, while things work, I had to set the gateway of Vmotion VMKernel default gateway, if it appears as the default gateway for the management interface as well which is a little disconcerting.

  I did some research and I found references to the use of das.allowNetworkx and das. AllowVmotionNetworks to control traffic HA, but I can't find anything to say if it will affect my current number.

  It has been suggested to create switches separated for the service console and Vmotion traffic, but to ensure the resilience it will take 4 of my 6 NICs, only leaving 2 for customer traffic, which is a little limited.

  Welcome to the VMTN Forums,

  Could you try the following:

  The das value. AllowVmotionNetworks to false. Add your default gateway to your management network which can be ping from the console. It should work?

  Duncan

  Blogs: http://www.yellow-bricks.com

  If you find this information useful, please give points to "correct" or "useful".

• LB vs Webcomponent switch servers OAM

  I have three servers of identity. I can do what follows from the Webpass
  
  (1) I can report two primary identity servers and the last Fail-over.
  (2) - or - I can point to three identity-servers as servers.
  
  To test whether the failover works for point # 2, I dropped one of the servers identity and the webpass still works. So, what is the advantage of creating a failover server? Anyway, failover is already supported when all servers are used to balance the load. Am I missing something?
  
  Thank you!
  Kabi

  The two techniques are valid ways to provide redundancy.

  Multiple primitive cancers is a way of distributing the payload and increase in capacity (descaling).

  Addition of failover is generally to ensure that you can maintain a capacity of minimum service in case you start to lose primary resources. I suggest you read up on the setting of 'failover threshold '.

  It is possible that you run with more capacity you need and that you do not configure failover of resources. It is also possible that, in a deployment dispersed geographically, and cross-configure the failover of the resources of the remote sites. It is a very flexible system.

  Hope this adds useful information to your thoughts.

  Mark

• RV042 v3 & RV082 v3: WAN Failover + restore VPN

  We have a v3 RV082 and RV042 v3 with latest firmware.

  They have all two Dual WAN (backup active Smartlink).

  They connect with each other via the VPN (with VPN enabled and configured backup Tunnel).

  When primary internet (WAN1) fails, and it switches to the internet backup (WAN2),

  We have to manually replace the VPN of WAN1 WAN2 interface to restore

  the VPN tunnel.

  We tried to create a second instance of VPN using WAN2, however it will not save

  due to a conflict of network with VPN original (even if we move the destination VPN

  IP and VPN backup tunnel IP).  I imagine that the conflict is the destination network.

  How do we automate the VPN interface change an outage of the internet?

  Or about what work can be done to ensure the VPN is restored after a

  failover of the Internet (WAN interface change).

  To address scenarios, you need the two operating sites in the double-wan load-balancing mode. The main tunnel is formed with two interfaces WAN1 and the backup tunnel is formed with two interfaces to WAN2.

• Failover port-group Set

  Hi all

  You override vSwitch order of failover for a Portgroup using Powercli.

  Thank you

  You can use the Set-NicTeamingPolicy cmdlet.

  Get-VirtualPortGroup -VMHost (Get-VMHost ) -Name  | Get-NicTeamingPolicy | Set-NicTeamingPolicy -MakeNicActive  -MakeNicStandby  -MakeNicUnused 
  

  ____________

  Blog: LucD notes

  Twitter: lucd22