《Cisco High Availability Options》由会员分享，可在线阅读，更多相关《Cisco High Availability Options（22页珍藏版）》请在金锄头文库上搜索。
1、Cisco Network Academy. All rights reserved. CCNP+ ISCW v1.0 IPsec VPNs Cisco High Availability Options Cisco Network Academy. All rights reserved. CCNP+ ISCW v1.0 High Availability for Cisco IOS IPsec VPNs Cisco Network Academy. All rights reserved. CCNP+ ISCW v1.0 Failures IPsec VPNs can experience
2、 any one of a number of different types of failures: Access link failure Remote peer failure Device failure Path failure IPsec should be designed and implemented with redundancy and high-availability mechanisms to mitigate these failures. Cisco Network Academy. All rights reserved. CCNP+ ISCW v1.0 R
3、edundancy Common solutions using one or more of these options: Two access links to mitigate access-link failures Multiple peers to mitigate peer failure Two local VPN devices to mitigate device failures Multiple independent paths to mitigate all path failures Cisco Network Academy. All rights reserv
4、ed. CCNP+ ISCW v1.0 Failure Detection Native IPsec uses DPD to detect failures in the path and remote peer failure. Any form of GRE over IPsec typically uses a routing protocol to detect failures (hello mechanism). HSRP is typically used to detect failures of local devices. VRRP and GLBP have simila
5、r failure-detection functionality. Cisco Network Academy. All rights reserved. CCNP+ ISCW v1.0 Dead Peer Detection IKE keepalives: Keepalives in periodic intervals DPD: Keepalives in periodic intervals if no data transmitted On-demand option Cisco Network Academy. All rights reserved. CCNP+ ISCW v1.
6、0 IPsec Backup Peer Cisco Network Academy. All rights reserved. CCNP+ ISCW v1.0 IPsec Backup Peer One HA design option is to use native IPsec and its HA mechanisms: DPD to detect failures Backup peers to take over new tunnels when primary peer becomes unavailable Cisco Network Academy. All rights re
7、served. CCNP+ ISCW v1.0 Configuration Example Router will first try primary peer. If primary peer is not available or becomes unavailable (DPD failure detection), the router tries backup peers in order as listed in the crypto map. Cisco Network Academy. All rights reserved. CCNP+ ISCW v1.0 Hot Stand
8、by Routing Protocol Cisco Network Academy. All rights reserved. CCNP+ ISCW v1.0 Hot Standby Routing Protocol HSRP can be used at: Headend: Two head-end IPsec devices appear as one to remote peers Remote site: Two IPsec gateways appear as one to local devices Active HSRP device uses a virtual IP and
9、MAC address. Standby HSRP device takes over virtual IP and MAC address when active HSRP device goes down. Cisco Network Academy. All rights reserved. CCNP+ ISCW v1.0 HSRP for Default Gateway at Remote Site All remote devices use virtual IP as default gateway. Backup router is only used when primary router is down. Cisco Network Academy. All rights reserved.
