Stateful Failover for IPSec [Cisco IOS Software Releases 12.3 T]

Table Of Contents

Stateful Failover for IPSec

Contents

Prerequisites for Stateful Failover for IPSec

Restrictions for Stateful Failover for IPSec

Information About Stateful Failover for IPSec

Supported Deployment Scenarios: Stateful Failover for IPSec

IPSec Stateful Failover for Remote Access Connections

How to Use Stateful Failover for IPSec

Enabling HSRP: IP Redundancy and a Virtual IP Address

Prerequisites for Spanning Tree Protocol and HSRP Stability

Restrictions

Troubleshooting Tips

Examples

What to Do Next

Enabling SSO

SSO: Interacting with IPSec and IKE

Prerequisites

Troubleshooting Tips

Examples

What to Do Next

Configuring Reverse Route Injection on a Crypto Map

Configuring RRI on Dynamic Crypto Map

Configuring RRI on a Static Crypto Map

Examples

What to Do Next

Enabling Stateful Failover for IKE and IPSec

Enabling Stateful Failover for IKE

Enabling Stateful Failover for IPSec

Enabling Stateful Failover for Tunnel Protection

What to Do Next

Protecting SSO Traffic

Examples

Managing and Verifying High Availability Information

Managing Anti-Replay Intervals

Examples

Managing and Verifying HA Configurations

Examples

Configuration Examples for Stateful Failover

Configuring IPSec Stateful Failover: Example

Configuring IPSec Stateful Failover for an Easy VPN Server: Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

clear crypto isakmp

clear crypto sa

clear crypto session

crypto map (interface IPSec)

crypto map redundancy replay-interval

debug crypto ha

debug crypto ipsec ha

debug crypto isakmp ha

local-ip (IPC transport-SCTP local)

local-port

redundancy inter-device

redundancy stateful

remote-ip (IPC transport-SCTP remote)

remote-port

scheme

security ipsec

show crypto ha

show crypto ipsec sa

show crypto isakmp sa

show crypto session

show redundancy

Stateful Failover for IPSec

Stateful failover for IP Security (IPSec) enables a router to continue processing and forwarding IPSec packets after a planned or unplanned outage occurs. Customers employ a backup (secondary) router that automatically takes over the tasks of the active (primary) router if the active router loses connectivity for any reason. This process is transparent to the user and does not require adjustment or reconfiguration of any remote peer.

Stateful failover for IPSec is designed to work in conjunction with stateful switchover (SSO) and Hot Standby Routing Protocol (HSRP). HSRP provides network redundancy for IP networks, ensuring that user traffic immediately and transparently recovers from failures in network edge devices or access circuits. That is, HSRP monitors both the inside and outside interfaces so that if either interface goes down, the whole router is deemed to be down and ownership of Internet Key Exchange (IKE) and IPSec security associations (SAs) is passed to the standby router (which transitions to the HSRP active state). SSO allows the active and standby routers to share IKE and IPSec state information so that each router has enough information to become the active router at any time. To configure stateful failover for IPSec, a network administrator should enable HSRP, assign a virtual IP address, and enable the SSO protocol.

Feature History for Stateful Failover for IPSec

Release

Modification

12.3(11)T

This feature was introduced.

12.3(14)T

The following enhancements were added for use with stateful failover:

•Improved scalability on the Cisco 7200 platforms, which can now support up to 2000 tunnels

•Support for public key infrastructure (PKI) and Easy VPN (EzVPN)

Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

Contents

•Prerequisites for Stateful Failover for IPSec

•Restrictions for Stateful Failover for IPSec

•Information About Stateful Failover for IPSec

•How to Use Stateful Failover for IPSec

•Configuration Examples for Stateful Failover

•Additional References

•Command Reference

Prerequisites for Stateful Failover for IPSec

Complete, Duplicate IPSec and IKE Configuration on the Active and Standby Devices

This document assumes that you have a complete IKE and IPSec configuration. (This document describes only how to add stateful failover to a working IPSec configuration.)

The IKE and IPSec configuration that is set up on the active device must be duplicated on the standby device. That is, the crypto configuration must be identical with respect to Internet Security Association and Key Management Protocol (ISAKMP) policy, ISAKMP keys (preshared), IPSec profiles, IPSec transform sets, all crypto map sets that are used for stateful failover, all access control lists (ACLs) that are used in match address statements on the crypto map sets, all AAA configurations used for crypto, client configuration groups, ip local pools used for crypto, and ISAKMP profiles.

Note None of the configuration information between the active and standby device is automatically transferred; the user is responsible for ensuring that the crypto configurations match on both devices. If the crypto configurations on both devices do not match, failover from the active device to the standby device will not be successful.

Device Requirements

•Stateful failover for IPSec requires that your network contains two identical routers that are available to be either the primary or secondary device. Both routers should be the same type of device, have the same CPU and memory, and have either no encryption accelerator or identical encryption accelerators.

•This feature is currently supported only on a limited number of platforms. To check the latest platform support, go to Cisco Feature Navigator at http://www.cisco.com/go/fn.

Restrictions for Stateful Failover for IPSec

When configuring redundancy for a virtual private network (VPN), the following restrictions exist:

•Both the active and standby devices must run the identical version of the Cisco IOS software, and both the active and standby devices must be connected via hub or switch.

•Only the VPN Acceleration Module (VAM), VAM2, and AIM-VPN/HPII+ hardware encryption accelerators are supported in a Cisco 3845 router, and the AIM-VPN/EPII+ hardware encryption accelerators are supported in a Cisco 3825 router.

•Only "box-to-box" failover is supported; that is, intrachassis failover is currently not supported.

•WAN interfaces between the active (primary) router and the standby (secondary) router are not supported. (HSRP requires inside interfaces and outside interfaces to be connected via LANs.)

•Load balancing is not supported; that is, no more than one device in a redundancy group can be active at any given time.

•Stateful failover of IPSec with Layer 2 Tunneling Protocol (L2TP) is not supported.

•IKE keepalives are not supported. (Enabling this functionality will cause the connection to be torn down after the standby router assumes ownership control.) However, dead peer detection (DPD) and periodic DPD are supported.

•IPSec idle timers are not supported when used with stateful failover.

•A stateful failover crypto map applied to an interface in a virtual route forwarding (VRF) instance is not supported. However, VRF-aware IPSec features are supported when a stateful failover crypto map is applied to an interface in the global VRF.

•Stateful failover is not compatible or interoperable with the State Synchronization Protocol (SSP) version of stateful failover (which is available in Cisco IOS Release 12.2YX1 and Cisco IOS Release 12.2SU).

Information About Stateful Failover for IPSec

To configure stateful failover for VPNs, you should understand the following concepts:

•Supported Deployment Scenarios: Stateful Failover for IPSec

•IPSec Stateful Failover for Remote Access Connections

Supported Deployment Scenarios: Stateful Failover for IPSec

It is recommended that you implement IPSec stateful failover in one of the following recommended deployment scenarios—a single interface scenario or a dual interface scenario.

In a single interface scenario, the VPN gateways use one LAN connection for both encrypted traffic arriving from remote peers and decrypted traffic flowing to inside hosts (see Figure 1). The single interface design allows customers to save money on router ports and subnets. This design is typically used if all traffic flowing in and out of the organization does not traverse the VPN routers.

Figure 1 Single Interface Network Topology

In a dual interface scenario, a VPN gateway has more than one interface, enabling traffic to flow in and out of the router via separate interfaces (see Figure 2). This scenario is typically used if traffic flowing in and out of a site must traverse the routers, so the VPN routers will provide the default route out of the network.

Figure 2 Dual Interface Network Topology

Table 1 lists the functionality available in both a single interface scenario and a dual interfaces scenario.

Table 1 IPSec StateFul Failover: Single and Dual Interface Functionality Overview

Single Interface

Dual Interface

Route Injection

Routes must be injected to provide the devices that are behind the VPN gateways with a next hop for traffic that requires encryption. Stateful failover for IPSec typically requires routes to be injected for this network topology.

If the VPN gateways are not the logical next hop for devices inside the network, the routes must be created and injected into the routing process. Thus, traffic that is returning from inside the network can be sent back to the VPN routers for IPSec services before it is sent out. A virtual IP (VIP) address cannot be used as the advertiser of routing updates, so flows must be synchronized via the injected routes.

If the VPN gateways are the next hop (default route) for all devices inside the network, the VIP address that is used on the inside interfaces can be used as the next hop. Thus, injection of the VPN routes is not required. However, static routes on inside hosts must be used to direct the routes to the next hop VIP address.

HSRP Configuration

The role of HSRP is simplified in a single interface design because if the only interface is disabled, the entire device is deemed unavailable. This functionality helps to avoid some of the routing considerations to be discussed in the next scenario.

Because each interface pair functions independently, you should configure HSRP so that multiple pairs of interfaces can be tracked. (That is, HSRP should not be configured on only one pair of interfaces or on both pairs of interfaces without each pair mutually tracking each other.) Mutual tracking means that if the outside interface does fail, the inside interface on the same router will also be deemed down, allowing for complete router failover to the secondary router.

Secure State Information

If secured-state information is passed between routers, the information is passed over the same interface as all other traffic.

The router has a separate inside and outside interface; thus, the inside interface can be used as a more secure channel for the exchange of state information.

Firewall Configuration

The VPN gateways can sit in front of the firewall or behind the firewall.

VPN gateways may sit behind or in front of a firewall, a firewall can be installed in parallel to the VPN gateways.

IPSec Stateful Failover for Remote Access Connections

The main difference between a remote access and a LAN-to-LAN connection is the use of Xauth and mode-config. IKE Xauth is often used to authenticate the user. IKE mode-config is often used to push security policy from the hub (concentrator) router to the user's IPSec implementation. Mode-config is also typically used to assign an internal company network IP address to a user.

In addition to the differences between a remote access configuration and a LAN-to-LAN configuration, you should note the following remote-access-server-specific functions:

•Assigned IP address—The IP address can be assigned to the client via one of the following options:

–Local IP pools. For local IP pools, the administrator must first configure identical local IP address pools on each router in the high availability (HA) pair (via the ip local pool client-address-pool command). This pool name can be applied in one of two places—in a group policy via the crypto isakmp client configuration group group-name (and the submode command pool pool-name) or in a client configuration via the crypto isakmp client configuration address-pool local local-pool command.

–RADIUS-assigned address. If you are using RADIUS authentication and the RADIUS server returns the Framed-IP-Address attribute, the concentrator will always assign that address to the client. It is recommended that you refer to your RADIUS server vendor's documentation, especially for vendors that allow you to configure address pools on the RADIUS server. Typically those servers require crypto accounting to work properly.

To enable accounting on the HA pair, you should issue the following commands on both Active and Standby devices: aaa accounting network radius-accounting start-stop group radius then apply radius-accounting either to the crypto isakmp profile or the crypto map set.

•RADIUS NAS-IP address—The HA pair should appear as a single device to the RADIUS server. Thus, both HA routers must communicate with the RADIUS server using the same IP address. However, when communicating with the RADIUS server, the router must use a physical IP address, not a virtual IP (VIP) address as the NAS-IP address of the router. To configure the RADIUS NAS-IP address for the HA pair, you must configure the same loopback address in the HA pair via interface loopback ip address command; thereafter, you must issue the ip radius source-interface loopback command in the HA pair. Finally, add the new loopback IP address to the RADIUS servers configuration so the RADIUS server can process requests from the HA pair.

For additional information on how to configure IPSec stateful failover for a remote access connection, see the section "Configuring IPSec Stateful Failover for an Easy VPN Server: Example" in this document.

How to Use Stateful Failover for IPSec

This section contains the following the procedures:

•Enabling HSRP: IP Redundancy and a Virtual IP Address (required)

•Enabling SSO (required)

•Configuring Reverse Route Injection on a Crypto Map (required)

•Enabling Stateful Failover for IKE and IPSec (required)

•Protecting SSO Traffic (optional)

•Managing and Verifying High Availability Information (optional)

Enabling HSRP: IP Redundancy and a Virtual IP Address

HSRP provides two services—IP redundancy and a VIP address. Each HSRP group may provide either or both of these services. IPSec stateful failover uses the IP redundancy services from only one HSRP standby group. It can use the VIP address from one or more HSRP groups. Use the following task to configure HSRP on the outside and inside interfaces of the router.

Note Perform this task on both routers (active and standby) and of both interfaces on each router.

Prerequisites for Spanning Tree Protocol and HSRP Stability

If a switch connects the active and standby routers, you must perform one of the following steps to ensure that the correct settings are configured on that switch:

•Enable the spanning-tree portfast command on every switch port that connects to a HSRP-enabled router interface.

•Disable the Spanning Tree Protocol (STP) on the switch only if your switch does not connect to other switches. Disabling spanning tree in a multi-switch environment may cause network instability.

•Enable the standby delay minimum [min-delay] reload [reload-delay] command if you do not have access to the switch. The reload-delay argument should be set to a value of at least 120 seconds. This command must be applied to all HSRP interfaces on both routers.

For more information on HSRP instability, see the document Avoiding HSRP Instability in a Switching Environment with Various Router Platforms.

Note You must perform at least one of these steps for correct HSRP operation.

Restrictions

•Both the inside (private) interface and the outside (public) interface must belong to separate HSRP groups, but the HSRP group number can be the same.

•The state of the inside interface and the outside interface must be the same—both interfaces must be in the active state or standby state; otherwise, the packets will not have a route out of the private network.

•Standby priorities should be equal on both active and standby routers. If the priorities are not equal, the higher priority router will unnecessarily take over as the active router, negatively affecting uptime.

•The IP addresses on the HSRP-tracked interfaces of the standby and active routers should both be either lower or higher on one router than the other. In the case of equal priorities (an HA requirement), HSRP will assign the active state on the basis of the IP address. If an addressing scheme exists so that the public IP address of Router A is lower than the public IP address of Router B, but the opposite is true for their private interfaces, an active/standby-standby/active split condition could exist which will break connectivity.

Note Each time an active device relinquishes control to become the standby device, the active device will reload. This functionality ensures that the state of the new standby device synchronizes correctly with the new active device.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type number

4. standby standby-group-number name standby-group-name

5. standby standby-group-number ip ip-address

6. standby standby-group-number track interface-name

7. standby [group-number] preempt

8. standby [group-number] timers [msec] hellotime [msec] holdtime

9. standby delay minimum [min-delay] reload [reload-delay]

10. Repeat.

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

interface type number
Example:

Router(config)# interface Ethernet 0/0

Configures an interface type for the router and enters interface configuration mode.

Step 4

standby standby-group-number name standby-group-name
Example:

Router(config-if)# standby 1 name HA-out

Assigns a user-defined group name to the HSRP redundancy group.

Note The standby-group-number argument should be the same for both routers that are on directly connected interfaces. However, the standby-group-name argument should be different between two (or more) groups on the same router.

The standby-group-number argument can be the same on the other pair of interfaces as well.

Step 5

standby standby-group-number ip ip-address
Example:

Router(config-if)# standby 1 ip 209.165.201.1

Assigns an IP address that is to be "shared" among the members of the HSRP group and owned by the primary IP address.

Note The virtual IP address must be configured identically on both routers (active and standby) that are on directly connected interfaces.

Step 6

standby standby-group-number track interface-name
Example:

Router(config-if)# standby 1 track Ethernet1/0

Configures HSRP to monitor the second interface so that if either of the two interfaces goes down, HSRP causes failover to the standby device.

Note Although this command is not required, it is recommended for dual interface configurations.

Step 7

standby [group-number] preempt
Example:

Router(config-if)# standby 1 preempt

Enables the active device to relinquish control because of an interface tracking event.

Step 8

standby [group-number] timers [msec] hellotime [msec] holdtime
Example:

Router(config-if)# standby 1 timers 1 5

(Optional) Configures the time between hello packets and the time before other routers declare the active Hot Standby or standby router to be down.

•holdtime—Amount of time the routers take to detect types of failure. A larger hold time means that failure detection will take longer.

For the best stability, it is recommended that you set the hold time between 5 and 10 times the hello interval time; otherwise, a failover could falsely occur when no actual failure has happened.

Step 9

standby delay minimum [min-delay] reload [reload-delay]
Example:

Router(config-if)# standby delay minimum reload 120

Configures the delay period before the initialization of HSRP groups.

Note It is suggested that you enter 120 as the value for the reload-delay argument and leave the min-delay argument at the preconfigured default value.

Step 10

Repeat.

Repeat this task on both routers (active and standby) and on both interfaces of each router.

Troubleshooting Tips

To help troubleshoot possible HSRP-related configuration problems, issue any of the following HSRP-related debug commands—debug standby errors, debug standby events, and debug standby packets [terse].

Examples

The following example shows how to configure HSRP on a router:
interface Ethernet0/0
 ip address 209.165.201.1 255.255.255.224
 standby 1 ip 209.165.201.3
 standby 1 preempt
 standby 1 name 
 standby 1 track Ethernet1/0
 standby delay reload 120
What to Do Next

After you have successfully configured HSRP on both the inside and outside interfaces, you should enable SSO as described the in the section "Enabling SSO."

Enabling SSO

Use this task to enable SSO, which is used to transfer IKE and IPSec state information between two routers.

SSO: Interacting with IPSec and IKE

SSO is a method of providing redundancy and synchronization for many Cisco IOS applications and features. SSO is necessary for IPSec and IKE to learn about the redundancy state of the network and to synchronize their internal application state with their redundant peers.

Prerequisites

•You should configure HSRP before enabling SSO.

•To avoid losing SCTP communication between peers, be sure to include the following commands to the local address section of the SCTP section of the IPC configuration:

–retransmit-timeout retran-min [msec] retra-max [msec]

–path-retransmit max-path-retries

–assoc-retransmit retries

SUMMARY STEPS

1. enable

2. configure terminal

3. redundancy inter-device

4. scheme standby standby-group-name

5. exit

6. ipc zone default

7. association 1

8. protocol sctp

9. local-port local-port-number

10. local-ip device-real-ip-address [device-real-ip-address2]

11. retransmit-timeout retran-min [msec] retra-max [msec]

12. path-retransmit max-path-retries

13. assoc-retransmit retries

14. exit

15. remote-port remote-port-number

16. remote-ip peer-real-ip-address [peer-real-ip-address2]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

redundancy inter-device
Example:

Router(config)# redundancy inter-device

Configures redundancy and enters inter-device configuration mode.

To exit inter-device configuration mode, use the exit command. To remove all inter-device configuration, use the no form of the command.

Step 4

scheme standby standby-group-name
Example:

Router(config-red-interdevice)# scheme standby HA-out

Defines the redundancy scheme that is to be used. Currently, "standby" is the only supported scheme.

•standby-group-name—Must match the standby name specified in the standby name interface configuration command. Also, the standby name should be the same on both routers.

Note Only the active or standby state of the standby group is used for SSO. The VIP address of the standby group is not required or used by SSO. Also, the standby group does not have to be part of any crypto map configuration.

Step 5

exit
Example:

Router(config-red-interdevice)# exit

Exits inter-device configuration mode.

Step 6

ipc zone default
Example:

Router(config)# ipc zone default

Configures the inter-device communication protocol, Inter-Process Communication (IPC), and enters IPC zone configuration mode.

Use this command to initiate the communication link between the active router and standby router.

Step 7

association 1
Example:

Router(config-ipczone)# association 1

Configures an association between the two devices and enters IPC association configuration mode.

Step 8

protocol sctp
Example:

Router(config-ipczone-assoc)# protocol sctp

Configures Stream Control Transmission Protocol (SCTP) as the transport protocol and enters SCTP protocol configuration mode.

Step 9

local-port local-port-number
Example:

Router(config-ipc-protocol-sctp)# local-port 5000

Defines the local SCTP port number that is used to communicate with the redundant peer and puts you in IPC transport - SCTP local configuration mode.

•local-port-number—There is not a default value. This argument must be configured for the local port to enable inter-device redundancy. Valid port values: 1 to 65535.

The local port number should be the same as the remote port number on the peer router.

Step 10

local-ip device-real-ip-address [device-real-ip-address2]
Example:

Router(config-ipc-local-sctp)# local-ip 10.0.0.1

Defines at least one local IP address that is used to communicate with the redundant peer.

The local IP addresses must match the remote IP addresses on the peer router. There can be either one or two IP addresses, which must be in the global VRF. A virtual IP address cannot be used.

Step 11

retransmit-timeout retran-min [msec] retra-max [msec]
Example:

Router(config-ipc-local-sctp)# retransmit-timeout 300 10000

Configures the maximum amount of time, in milliseconds, that SCTP will wait before retransmitting data.

•retran-min: 300 to 60000; default: 300

•retran-max: 300 to 60000; default: 600

Step 12

path-retransmit max-path-retries
Example:

Router(config-ipc-local-sctp)# path-retransmit 10

Configures the number of consecutive retransmissions SCTP will perform before failing a path within an association.

•max-path-retries: 2 to 10; default: 4 retries

Step 13

assoc-retransmit retries
Example:

Router(config-ipc-local-sctp)# assoc-retransmit 10

Configures the number of consecutive retransmissions SCTP will perform before failing an association.

•retries: 2 to 10; default: 4 retries

Step 14

exit
Example:

Router(config-ipc-local-sctp)# exit

Exits IPC transport - SCTP local configuration mode.

Step 15

remote-port remote-port-number
Example:

Router(config-ipc-protocol-sctp)# remote-port 5000

Defines the remote SCTP port number that is used to communicate with the redundant peer and puts you in IPC transport - SCTP remote configuration mode.

Note remote-port-number—There is not a default value. This argument must be configured for the remote port to enable inter-device redundancy. Valid port values: 1 to 65535.

The remote port number should be the same as the local port number on the peer router.

Step 16

remote-ip peer-real-ip-address [peer-real-ip-address2]
Example:

Router(config-ipc-remote-sctp)# remote-ip 10.0.0.2

Defines at least one remote IP address of the redundant peer that is used to communicate with the local device.

All remote IP addresses must refer to the same device.

A virtual IP address cannot be used.

Troubleshooting Tips

To help troubleshoot possible SSO-related configuration problems, issue the debug redundancy command.

Examples

The following example shows how to enable SSO:
!
redundancy inter-device
 scheme standby HA-out
!
!
ipc zone default
 association 1
  no shutdown
  protocol sctp
   local-port 5000
    local-ip 10.0.0.1
    retransmit-timeout 300 10000
    path-retransmit 10
    assoc-retransmit 10
   remote-port 5000
    remote-ip 10.0.0.2
!
What to Do Next

After you have enabled SSO, you should configure reverse route injection (RRI) on a crypto map as shown in the following section.

Configuring Reverse Route Injection on a Crypto Map

You should configure RRI on all existing crypto maps that you want to use with stateful failover. RRI is used with stateful failover so routers on the inside network can learn about the correct path to the current active device. When failover occurs, the new active device injects the RRI routes into its IP routing table and sends out routing updates to its routing peers.

Use one of the following tasks to configure RRI on a dynamic or static crypto map.

•Configuring RRI on Dynamic Crypto Map

•Configuring RRI on a Static Crypto Map

Configuring RRI on Dynamic Crypto Map

Dynamic crypto map entries, like regular static crypto map entries, are grouped into sets. A set is a group of dynamic crypto map entries all with the same dynamic map name but each with a different dynamic sequence number. Each member of the set may be configured for RRI.

SUMMARY STEPS

1. enable

2. configure terminal

3. crypto dynamic-map map-name seq-num

4. reverse-route

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

crypto dynamic-map map-name seq-num
Example:

Router(config)# crypto dynamic-map mymap 10

Creates a dynamic crypto map entry and enters crypto map configuration mode.

Step 4

reverse-route
Example:

Router(config-crypto-map)# reverse-route

Enables RRI for a dynamic crypto map.

Configuring RRI on a Static Crypto Map

Static crypto map entries are grouped into sets. A set is a group of static crypto map entries all with the same static map name but each with a different sequence number. Each static crypto map in the map set can be configured for RRI. Use this task to configure RRI on a static crypto map.

SUMMARY STEPS

1. enable

2. configure terminal

3. crypto map map-name seq-num ipsec-isakmp

4. reverse-route

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

crypto map map-name seq-num ipsec-isakmp
Example:

Router(config)# crypto map to-peer-outside 10 ipsec-isakmp

Enters crypto map configuration mode and creates or modifies a crypto map entry.

Step 4

reverse-route
Example:

Router(config-crypto-map)# reverse-route

Dynamically creates static routes based on crypto ACLs.

Examples

The following example shows how to configure RRI on the static crypto map "to-peer-outside":
crypto map to-peer-outside redundancy replay-interval inbound 1000 outbound 10000
crypto map to-peer-outside 10 ipsec-isakmp 
 set peer 209.165.200.225
 set transform-set trans1 
 match address peer-outside
 reverse-route
What to Do Next

After you have configured RRI, you can enable stateful failover for IPSec and IKE.

Enabling Stateful Failover for IKE and IPSec

Use the following tasks to configure stateful failover for IPSec, IKE, and tunnel protection:

•Enabling Stateful Failover for IKE

•Enabling Stateful Failover for IPSec

•Enabling Stateful Failover for Tunnel Protection

Enabling Stateful Failover for IKE

There is no specific command-line interface (CLI) necessary to enable stateful failover for IKE. It is enabled for a particular VIP address when a stateful failover crypto map is applied to an interface.

Enabling Stateful Failover for IPSec

Use this task to enable stateful failover for IPSec. All IPSec state information is transferred from the active router to the standby router via the SSO redundancy channel that was specified in the task "Enabling SSO."

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type number

4. crypto map map-name [redundancy standby-group-name [stateful]]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

interface type number
Example:

Router(config)# interface Ethernet 0/0

Defines an interface that has already been configured for redundancy and enters interface configuration mode.

Step 4

crypto map map-name [redundancy standby-group-name [stateful]]
Example:

Router(config-if)# crypto map to-peer-outside redundancy HA-out stateful

Binds the crypto map on the specified interface to the redundancy group.

Note Although the standby group does not have to be the same group that was used when enabling SSO, it does have to be the same group that was used with the standby ip command on this interface.

This crypto map will use the same VIP address for both IKE and IPSec to communicate with peers.

Troubleshooting Tips

To help troubleshoot possible IPSec HA-related problems, issue the debug crypto ipsec ha [detail] [update] command.

Examples

The following example shows how to configure IPSec stateful failover on the crypto map "to-peer-outside":
interface Ethernet0/0
 ip address 209.165.201.1 255.255.255.224
 standby 1 ip 209.165.201.3
 standby 1 preempt
 standby 1 name HA-out
 standby 1 track Ethernet1/0
 crypto map to-peer-outside redundancy HA-out stateful
Enabling Stateful Failover for Tunnel Protection

Use an existing IPSec profile to configure stateful failover for tunnels using IPSec. (You do not configure the tunnel interface as you would with a crypto map configuration.)

Restrictions

The tunnel source address must be a VIP address, and it must not be an interface name.

SUMMARY STEPS

1. enable

2. configure terminal

3. crypto ipsec profile name

4. redundancy standby-group-name stateful

5. exit

6. interface tunnel number

7. tunnel protection ipsec profile name

8. tunnel source virtual-ip-address

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

crypto ipsec profile name
Example:

Router(config)# crypto ipsec profile peer-profile

Defines the IPSec parameters that are to be used for IPSec encryption between two routers and enters crypto map configuration mode.

Step 4

redundancy standby-group-name stateful
Example:

Router(config-crypto-map)# redundancy HA-out stateful

Configures stateful failover for tunnels using IPSec.

Step 5

exit
Example:

Router(config-crypto-map)# exit

Exits crypto map configuration mode.

Step 6

interface tunnel number
Example:

Router(config)# interface tunnel 5

Configures a tunnel interface and enters interface configuration mode

•number—Specifies the number of the interface that you want to create or configure. There is no limit on the number of tunnel interfaces you can create.

Step 7

tunnel protection ipsec profile name
Example:

Router(config-if)# tunnel protection ipsec profile catprofile

Associates a tunnel interface with an IPSec profile.

name—Specifies the name of the IPSec profile; this value must match the name specified in the crypto ipsec profile name command.

Step 8

tunnel source virtual-ip-address
Example:

Router(config-if)# tunnel source 10.1.1.1

Sets source address for a tunnel interface.

•virtual-ip-address—Must be a VIP address.

Note Do not use the interface name as the tunnel source.

Examples

The following example shows how to configure stateful failover for tunnel protection:
crypto ipsec profile peer-profile
  redundancy HA-out stateful
interface Tunnel1
 ip unnumbered Loopback0
 tunnel source 209.165.201.3
 tunnel destination 10.0.0.5
 tunnel protection ipsec profile peer-profile
!
interface Ethernet0/0
 ip address 209.165.201.1 255.255.255.224
 standby 1 ip 209.165.201.3
 standby 1 name HA-out
What to Do Next

After you have configured stateful failover, you can use the CLI to protect, verify, and manage your configurations. For more information on completing these tasks, see the sections "Protecting SSO Traffic" and "Managing and Verifying High Availability Information."

Protecting SSO Traffic

Use this task to secure a redundancy group via an IPSec profile. To configure SSO traffic protection, the active and standby devices must be directly connected to each other via Ethernet networks.

The crypto maps that are automatically generated when protecting SSO traffic are applied to each interface, which corresponds to an IP address that was specified via the local-ip command. Traffic that is destined for an IP address that was specified via the remote-ip command is forced out of the crypto-map-configured interface via an automatically created static host route.

Note If you are certain that the SSO traffic between the redundancy group runs on a physically secure interface, you do not have to configure SSO traffic protection.

SUMMARY STEPS

1. enable

2. configure terminal

3. crypto isakmp key keystring address peer-address

4. crypto ipsec transform-set transform-set-name transform-set-list

5. crypto ipsec profile profile-name

6. set transform-set transform-set-name

7. exit

8. redundancy inter-device

9. security ipsec profile-name

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

crypto isakmp key keystring address peer-address
Example:

Router(config)# crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0

Configures a preshared authentication key.

•peer-address—The SCTP remote IP address.

Step 4

crypto ipsec transform-set transform-set-name transform-set-list
Example:

Router(config)# crypto ipsec transform-set trans2 ah-md5-hmac esp-aes

Configures a transform set that defines the packet format and cryptographic algorithms used for IPSec.

Step 5

crypto ipsec profile profile-name
Example:

Router(config)# crypto ipsec profile sso-secure

Defines an IPSec profile that describes how the traffic will be protected.

Step 6

set transform-set transform-set-name
Example:

Router(config-crypto-map)# set transform-set trans2

Specifies which transform sets can be used with the IPSec profile.

Step 7

exit
Example:

Router(config-crypto-map)# exit

Exits crypto map configuration mode.

Step 8

redundancy inter-device
Example:

Router(config)# redundancy inter-device

Configures redundancy and enters inter-device configuration mode.

Step 9

security ipsec profile-name
Example:

Router(config-red-interdevice)# security ipsec sso-secure

Applies the IPSec profile to the redundancy group communications, protecting all SSO traffic that is passed between the active and standby device.

Examples

The following example shows how to configure SSO traffic protection:
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 no-xauth
!
crypto ipsec transform-set trans2 ah-md5-hmac esp-aes 
!         
crypto ipsec profile sso-secure
 set transform-set trans2 
!
redundancy inter-device
 scheme standby HA-out
 security ipsec sso-secure
Managing and Verifying High Availability Information

Use any of the following optional tasks to secure and manage your high availability configurations:

•Managing Anti-Replay Intervals

•Managing and Verifying HA Configurations

Managing Anti-Replay Intervals

Use this optional task to modify the interval in which an IP redundancy-enabled crypto map forwards anti-replay updates from the active router to the standby router.

SUMMARY STEPS

1. enable

2. configure terminal

3. crypto map map-name redundancy replay-interval inbound in-value outbound out-value

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

crypto map map-name redundancy replay-interval inbound in-value outbound out-value
Example:

Router(config)# crypto map to-peer-outside redundancy replay-interval inbound 1000 outbound 10000

Modifies the interval at which inbound and outbound replay counters are passed from an active device to a standby device.

•inbound in-value—Number of inbound packets that are processed before an anti-replay update is sent from the active router to the standby router. Default value: one update every 1,000 packets.

•outbound out-value—Number of outbound packets that are processed before an anti-replay update is sent from the active router to the standby router. Default value: one update every 100,000 packets.

Examples

The following example shows how to modify replay counter intervals between the active and standby devices on the crypto map "to-peer-outside":
crypto map to-peer-outside redundancy replay-interval inbound 1000 outbound 10000
crypto map to-peer-outside 10 ipsec-isakmp 
 set peer 209.165.200.225
 set transform-set trans1 
 match address peer-outside
Managing and Verifying HA Configurations

Use any of the steps within this optional task to display and verify the high availability configurations.

SUMMARY STEPS

1. enable

2. show redundancy [states | inter-device]

3. show crypto isakmp sa [active | standby]

4. show crypto ipsec sa [active | standby]

5. show crypto session [active | standby]

6. show crypto ha

7. clear crypto isakmp [active | standby]

8. clear crypto sa [active | standby]

9. clear crypto session [active | standby]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

show redundancy [states | inter-device]
Example:

Router# show redundancy states

Displays the current state of SSO on the configured device.

After the two devices have negotiated with each other, one device should show an "ACTIVE" state and the other device should show a "STANDBY HOT" state.

Step 3

show crypto isakmp sa [active | standby]
Example:

Router# show crypto isakmp sa active

Displays IKE SAs present on the device.

An "ACTIVE" or "STDBY" state is shown for each SA.

•The active keyword displays only ACTIVE, HA-enabled SAs; The standby keyword displays only STDBY, HA-enabled SAs.

Step 4

show crypto ipsec sa [active | standby]
Example:

Router# show crypto ipsec sa active

Displays IPSec SAs present on the device.

An "ACTIVE" or "STDBY" state is shown for each SA.

•The active keyword displays only ACTIVE, HA-enabled SAs; The standby keyword displays only STDBY, HA-enabled SAs.

Step 5

show crypto session [active | standby]
Example:

Router# show crypto session active

Displays crypto sessions that are currently present on the device.

An "ACTIVE" or "STANDBY" state is shown as part of the state of each session, such as "UP-STANDBY."

Only HA-enabled SAs are shown.

Step 6

show crypto ha
Example:

Router# show crypto ha

Displays all virtual IP addresses that are currently in use by IPSec and IKE.

Step 7

clear crypto isakmp [active | standby]
Example:

Router# clear crypto isakmp active

Clears IKE SAs.

When this command is issued on the standby device, all standby IKE SAs are resynchronized from the active device.

•The active keyword clears only IKE HA-enabled SAs in the active state; the standby keyword clears only IKE HA-enabled SAs in the standby state.

Step 8

clear crypto sa [active | standby]
Example:

Router# clear crypto sa active

Clears IPSec SAs.

When this command is issued on the standby device, all standby IPSec SAs are resynchronized from the active device.

•The active keyword clears only IPSec HA-enabled SAs in the active state; the standby keyword clears only IPSec HA-enabled SAs in the standby state.

Step 9

clear crypto session [active | standby]
Example:

Router# clear crypto session active

Clears both IKE and IPSec SAs.

Any standby SAs will resynchronize from the active device after they are cleared on the standby. Only HA-enabled SAs are cleared from the device.

Examples

Verifying the Active Device:Examples
Router# show redundancy states
       my state = 13 -ACTIVE 
     peer state = 8  -STANDBY HOT 
           Mode = Duplex
        Unit ID = 0
     Split Mode = Disabled
   Manual Swact = Enabled
 Communications = Up
   client count = 7
 client_notification_TMR = 30000 milliseconds
          keep_alive TMR = 4000 milliseconds
        keep_alive count = 0 
    keep_alive threshold = 7 
           RF debug mask = 0x0   
Router# show crypto isakmp sa active
dst             src             state          conn-id slot status
209.165.201.3   209.165.200.225 QM_IDLE              5    0 ACTIVE
Router# show crypto ipsec sa active
interface:Ethernet0/0
    Crypto map tag:to-peer-outside, local addr 209.165.201.3
   protected vrf:(none)
   local  ident (addr/mask/prot/port):(192.168.0.1/255.255.255.255/0/0)
   remote ident (addr/mask/prot/port):(172.16.0.1/255.255.255.255/0/0)
   current_peer 209.165.200.225 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps:3, #pkts encrypt:3, #pkts digest:3
    #pkts decaps:4, #pkts decrypt:4, #pkts verify:4
    #pkts compressed:0, #pkts decompressed:0
    #pkts not compressed:0, #pkts compr. failed:0
    #pkts not decompressed:0, #pkts decompress failed:0
    #send errors 0, #recv errors 0
     local crypto endpt.:209.165.201.3, remote crypto endpt.:209.165.200.225
     path mtu 1500, media mtu 1500
     current outbound spi:0xD42904F0(3559458032)
     inbound esp sas:
      spi:0xD3E9ABD0(3555306448)
        transform:esp-3des ,
        in use settings ={Tunnel, }
        conn id:2006, flow_id:6, crypto map:to-peer-outside
        sa timing:remaining key lifetime (k/sec):(4586265/3542)
             HA last key lifetime sent(k):(4586267)
        ike_cookies:9263635C CA4B4E99 C14E908E 8EE2D79C
        IV size:8 bytes
        replay detection support:Y
        Status:ACTIVE
inbound ah sas:
      spi: 0xF3EE3620(4092474912)
        transform: ah-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 2006, flow_id: 6, crypto map: to-peer-outside
        sa timing: remaining key lifetime (k/sec): (4586265/3542)
             HA last key lifetime sent(k): (4586267)
        ike_cookies: 9263635C CA4B4E99 C14E908E 8EE2D79C
        replay detection support: Y
        Status: ACTIVE
     inbound pcp sas:
     outbound esp sas:
      spi: 0xD42904F0(3559458032)
        transform: esp-3des ,
        in use settings ={Tunnel, }
        conn id: 2009, flow_id: 9, crypto map: to-peer-outside
        sa timing: remaining key lifetime (k/sec): (4586266/3542)
             HA last key lifetime sent(k): (4586267)
        ike_cookies: 9263635C CA4B4E99 C14E908E 8EE2D79C
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE
     outbound ah sas:
      spi: 0x75251086(1965363334)
        transform: ah-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 2009, flow_id: 9, crypto map: to-peer-outside
        sa timing: remaining key lifetime (k/sec): (4586266/3542)
             HA last key lifetime sent(k): (4586267)
        ike_cookies: 9263635C CA4B4E99 C14E908E 8EE2D79C
        replay detection support: Y
        Status: ACTIVE
     outbound pcp sas:
Router# show crypto session active
Crypto session current status
Interface: Ethernet0/0
Session status: UP-ACTIVE     
Peer: 209.165.200.225 port 500 
  IKE SA: local 209.165.201.3/500 remote 209.165.200.225/500 Active 
  IKE SA: local 209.165.201.3/500 remote 209.165.200.225/500 Active 
  IPSEC FLOW: permit ip host 192.168.0.1 host 172.16.0.1 
        Active SAs: 4, origin: crypto map
Router# show crypto ha
IKE VIP: 209.165.201.3
  stamp: 74 BA 70 27 9C 4F 7F 81 3A 70 13 C9 65 22 E7 76 
IPSec VIP: 209.165.201.3
IPSec VIP: 255.255.255.253
IPSec VIP: 255.255.255.254
Verifying the Standby Device: Examples
Router# show redundancy states
       my state = 8  -STANDBY HOT 
     peer state = 13 -ACTIVE 
           Mode = Duplex
        Unit ID = 0
     Split Mode = Disabled
   Manual Swact = Enabled
 Communications = Up
   client count = 7
 client_notification_TMR = 30000 milliseconds
          keep_alive TMR = 4000 milliseconds
        keep_alive count = 1 
    keep_alive threshold = 7 
           RF debug mask = 0x0 
Router# show crypto isakmp sa standby
dst             src             state          conn-id slot status
209.165.201.3   209.165.200.225 QM_IDLE              5    0 STDBY 
Router# show crypto ipsec sa standby
interface:Ethernet0/0
    Crypto map tag:to-peer-outside, local addr 209.165.201.3
   protected vrf:(none)
   local  ident (addr/mask/prot/port):(192.168.0.1/255.255.255.255/0/0)
   remote ident (addr/mask/prot/port):(172.16.0.1/255.255.255.255/0/0)
   current_peer 209.165.200.225 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps:0, #pkts encrypt:0, #pkts digest:0
    #pkts decaps:0, #pkts decrypt:0, #pkts verify:0
    #pkts compressed:0, #pkts decompressed:0
    #pkts not compressed:0, #pkts compr. failed:0
    #pkts not decompressed:0, #pkts decompress failed:0
    #send errors 0, #recv errors 0
     local crypto endpt.:209.165.201.3, remote crypto endpt.:209.165.200.225
     path mtu 1500, media mtu 1500
     current outbound spi:0xD42904F0(3559458032)
     inbound esp sas:
      spi:0xD3E9ABD0(3555306448)
        transform:esp-3des ,
        in use settings ={Tunnel, }
        conn id:2012, flow_id:12, crypto map:to-peer-outside
        sa timing:remaining key lifetime (k/sec):(4441561/3486)
             HA last key lifetime sent(k):(4441561)
        ike_cookies:00000000 00000000 00000000 00000000
        IV size:8 bytes
        replay detection support:Y
        Status:STANDBY
     inbound ah sas:
      spi:0xF3EE3620(4092474912)
        transform:ah-md5-hmac ,
        in use settings ={Tunnel, }
        conn id:2012, flow_id:12, crypto map:to-peer-outside
        sa timing:remaining key lifetime (k/sec):(4441561/3486)
             HA last key lifetime sent(k):(4441561)
        ike_cookies:00000000 00000000 00000000 00000000
        replay detection support:Y
        Status:STANDBY
     inbound pcp sas:
     outbound esp sas:
      spi:0xD42904F0(3559458032)
        transform:esp-3des ,
        in use settings ={Tunnel, }
        conn id:2011, flow_id:11, crypto map:to-peer-outside
        sa timing:remaining key lifetime (k/sec):(4441561/3485)
             HA last key lifetime sent(k):(4441561)
        ike_cookies:00000000 00000000 00000000 00000000
        IV size:8 bytes
        replay detection support:Y
        Status:STANDBY
     outbound ah sas:
      spi:0x75251086(1965363334)
        transform:ah-md5-hmac ,
        in use settings ={Tunnel, }
        conn id:2011, flow_id:11, crypto map:to-peer-outside
        sa timing:remaining key lifetime (k/sec):(4441561/3485)
             HA last key lifetime sent(k):(4441561)
        ike_cookies:00000000 00000000 00000000 00000000
        replay detection support:Y
        Status:STANDBY
     outbound pcp sas:
Router# show crypto session standby
Crypto session current status
Interface:Ethernet0/0
Session status:UP-STANDBY    
Peer:209.165.200.225 port 500 
  IKE SA:local 209.165.201.3/500 remote 209.165.200.225/500 Active 
  IPSEC FLOW:permit ip host 192.168.0.1 host 172.16.0.1 
        Active SAs:4, origin:crypto map
Router# show crypto ha
IKE VIP:209.165.201.3
  stamp:74 BA 70 27 9C 4F 7F 81 3A 70 13 C9 65 22 E7 76 
IPSec VIP:209.165.201.3
IPSec VIP:255.255.255.253
IPSec VIP:255.255.255.254
ha-R2#
Verifying the Active and Standby SAs: Example

The following sample output shows SAs of both the active and standby devices:
Router# show crypto isakmp sa
dst             src             state          conn-id slot status
209.165.201.3   209.165.200.225 QM_IDLE              2    0 STDBY 
10.0.0.1        10.0.0.2        QM_IDLE              1    0 ACTIVE
Configuration Examples for Stateful Failover

This section contains the following comprehensive IPSec stateful failover configuration examples:

•Configuring IPSec Stateful Failover: Example

•Configuring IPSec Stateful Failover for an Easy VPN Server: Example

Configuring IPSec Stateful Failover: Example

Figure 3 and the following sample outputs from the show running-config command illustrate how to configure stateful failover on two devices—Ha-R1 and Ha-R2.

Figure 3 IPSec Stateful Failover Sample Topology

Stateful Failover Configuration on Ha-R1
Ha-R1#show running-config
Building configuration...
Current configuration :2086 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ha-R1
!
boot-start-marker
boot-end-marker
!
!
redundancy inter-device
 scheme standby HA-out
 security ipsec sso-secure
!
logging buffered 10000000 debugging
logging rate-limit console 10000
!
!
ipc zone default
 association 1
  no shutdown
  protocol sctp
   local-port 5000
    local-ip 10.0.0.1
   remote-port 5000
    remote-ip 10.0.0.2
!
clock timezone PST 0
no aaa new-model
ip subnet-zero
!
crypto isakmp policy 1
 authentication pre-share
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 no-xauth
!         
!
crypto ipsec transform-set trans1 ah-md5-hmac esp-3des 
crypto ipsec transform-set trans2 ah-md5-hmac esp-aes 
!
crypto ipsec profile sso-secure
 set transform-set trans2 
!
!
crypto map to-peer-outside redundancy replay-interval inbound 1000 outbound 10000
crypto map to-peer-outside 10 ipsec-isakmp 
 set peer 209.165.200.225
 set transform-set trans1 
 match address peer-outside
!
!
!
interface Ethernet0/0
 ip address 209.165.201.1 255.255.255.224
 standby 1 ip 209.165.201.3
 standby 1 preempt
 standby 1 name HA-out
 standby 1 track Ethernet1/0
 standby delay reload 120
 crypto map to-peer-outside redundancy HA-out stateful
!
interface Ethernet1/0
 ip address 10.0.0.1 255.255.255.0
 standby 2 ip 10.0.0.3
 standby 2 preempt
 standby 2 name HA-out
 standby delay reload 120
 standby 2 track Ethernet0/0
!
interface Serial2/0
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial3/0
 no ip address
 shutdown
 serial restart-delay 0
!
ip classless
ip route 0.0.0.0 0.0.0.0 209.165.201.5
ip route 192.168.0.0 255.255.0.0
no ip http server
no ip http secure-server
!
!
!
ip access-list extended peer-outside
 permit ip host 192.168.0.1 host 172.16.0.1
!
!
control-plane
!
!
line con 0
 exec-timeout 0 0
 transport preferred all
 transport output all
line aux 0
 transport preferred all
 transport output all
line vty 0 4
 login
 transport preferred all
 transport input all
 transport output all
!
end
Stateful Failover Configuration on Ha-R2
Ha-R2#show running-config
Building configuration...
Current configuration :2100 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ha-R2
!
boot-start-marker
boot-end-marker
!
!
redundancy inter-device
 scheme standby HA-out
 security ipsec sso-secure
!
logging buffered 10000000 debugging
logging rate-limit console 10000
!
!
ipc zone default
 association 1
  no shutdown
  protocol sctp
   local-port 5000
    local-ip 10.0.0.2
   remote-port 5000
    remote-ip 10.0.0.1
!
clock timezone PST 0
no aaa new-model
ip subnet-zero
!
!
crypto isakmp policy 1
 authentication pre-share
 lifetime 120
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 no-xauth
!
!
crypto ipsec transform-set trans1 ah-md5-hmac esp-3des 
crypto ipsec transform-set trans2 ah-md5-hmac esp-aes 
!
crypto ipsec profile sso-secure
 set transform-set trans2 
!
!
crypto map to-peer-outside redundancy replay-interval inbound 1000 outbound 10000
crypto map to-peer-outside 10 ipsec-isakmp 
 set peer 209.165.200.225
 set transform-set trans1 
 match address peer-outside
!
!
!
interface Ethernet0/0
 ip address 209.165.201.2 255.255.255.224
 standby 1 ip 209.165.201.3
 standby 1 preempt
 standby 1 name HA-out
 standby 1 track Ethernet1/0
 standby delay reload 120
 crypto map to-peer-outside redundancy HA-out stateful
!
interface Ethernet1/0
 ip address 10.0.0.2 255.255.255.0
 standby 2 ip 10.0.0.3
 standby 2 preempt
 standby 2 name HA-out
 standby delay reload 120
 standby 2 track Ethernet0/0
!
interface Serial2/0
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial3/0
 no ip address
 shutdown
 serial restart-delay 0
!
ip classless
ip route 0.0.0.0 0.0.0.0 209.165.201.5
ip route 192.168.0.0 255.255.0.0
no ip http server
no ip http secure-server
!
!
!
ip access-list extended peer-outside
 permit ip host 192.168.0.1 host 172.16.0.1
!
!
control-plane
!
!
line con 0
 exec-timeout 0 0
 transport preferred all
 transport output all
line aux 0
 transport preferred all
 transport output all
line vty 0 4
 login    
 transport preferred all
 transport input all
 transport output all
!
end
Ha-R2#
Configuring IPSec Stateful Failover for an Easy VPN Server: Example

The following sample outputs from the show running-config command show how to configure stateful failover for a remote access connection via an Easy VPN server:

Stateful Failover for an Easy VPN Server Configuration on RAHA-R1
RAHA-R1# show running-config
Building configuration...
Current configuration :3829 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname RAHA-R1
!
boot-start-marker
boot-end-marker
!
redundancy inter-device
 scheme standby HA-out
!
username remote_user password 0 letmein
!
ipc zone default
 association 1
  no shutdown
  protocol sctp
   local-port 5000
    local-ip 10.0.0.1
   remote-port 5000
    remote-ip 10.0.0.2
!
aaa new-model
!
!
! Enter the following command if you are doing Xauth locally.
aaa authentication login local_xauth local
!
! Enter the following command if you are doing Xauth remotely via RADIUS.
!aaa authentication login radius_xauth group radius
!
! Enter the following command if you are not doing Xauth
!aaa authentication login no_xauth none
!
! Enter the following command if you are doing local group authentication.
aaa authorization network local_auth local 
!
! Enter the following command if you are doing group authentication remotely via RADIUS.
!aaa authorization network radius_auth group radius 
!
!
! Enter the following command if you are doing Xauth remotely via RADIUS.
!
aaa accounting network radius_accounting start-stop group radius
aaa session-id common
ip subnet-zero
!
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
!         
! Enter the following command if you are doing group authentication locally. 
crypto isakmp client configuration group unity
 key cisco123
 domain cisco.com
 pool client-address-pool
!         
!         
crypto ipsec transform-set trans1 esp-3des esp-sha-hmac
!
crypto dynamic-map to-remote-client 10
 set transform-set trans1 
 reverse-route remote-peer
!
! Use this map if you want to do local group authentication and Xauth.
crypto map to_peer_outside_local_xauth client authentication list local_xauth
crypto map to_peer_outside_local_xauth isakmp authorization list local_auth
crypto map to_peer_outside_local_xauth client configuration address respond
crypto map to_peer_outside_local_xauth 10 ipsec-isakmp dynamic to-remote-client 
!
! Use this map if you want to use Radius for group authentication and Xauth.
!crypto map to_peer_outside_radius_xauth isakmp client authentication list radius_xauth
!crypto map to_peer_outside_radius_xauth client accounting list radius_accounting
!crypto map to_peer_outside_radius_xauth isakmp authorization list radius_auth
!crypto map to_peer_outside_radius_xauth isakmp client configuration address respond
!crypto map to_peer_outside_radius_xauth isakmp 10 ipsec-isakmp dynamic to-remote-client 
!
! Use this map if you want to do local group authentication and no Xauth
!crypto map to_peer_outside_no_xauth isakmp authorization list local_auth
!crypto map to_peer_outside_no_xauth configuration address respond
!crypto map to_peer_outside_no_xauth 10 ipsec-isakmp dynamic to-remote-client 
!
interface Ethernet0/0
 ip address 209.165.201.1 255.255.255.224
 standby 1 ip 209.165.201.3
 standby 1 preempt
 standby 1 name HA-out
 standby 1 track Ethernet1/0
 standby delay reload 120
 crypto map to_peer_outside_local_xauth redundancy HA-out stateful
!
interface Ethernet1/0
 ip address 10.0.0.1 255.255.255.0
 standby 2 ip 10.0.0.3
 standby 2 preempt
 standby 2 name HA-out
 standby 2 track Ethernet0/0
 standby delay reload 120
!
! Enable loopback0 if you are using radius for Xauth, group auth, or accounting with 
! crypto HA
!interface loopback0
! ip address 192.168.100.1 255.255.255.255
!
! Enable this command if you are using radius for Xauth, group auth, or accounting with 
! crypto HA
!ip radius source-interface loopback0
!
ip local pool client-address-pool 50.0.0.1 50.0.0.254
ip classless
ip route 0.0.0.0 0.0.0.0 209.165.201.5
ip route 192.168.0.0 255.255.255.0 10.0.0.5
!
radius-server host 192.168.0.0 255.255.0.0 auth-port 1845 acct-port 1846
radius-server key radius123
!
control-plane
! 
!         
line con 0
 exec-timeout 0 0
line aux 0
line vty 0 4
!         
end
Stateful Failover for an Easy VPN Server Configuration on RAHA-R2
RAHA-R2# show running-config
Building configuration...
Current configuration :3829 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname RAHA-R2
!
boot-start-marker
boot-end-marker
!
redundancy inter-device
 scheme standby HA-out
!
username remote_user password 0 letmein
!
ipc zone default
 association 1
  no shutdown
  protocol sctp
   local-port 5000
    local-ip 10.0.0.2
   remote-port 5000
    remote-ip 10.0.0.1
!
aaa new-model
!
!
! Enter the following command if you are doing Xauth locally.
aaa authentication login local_xauth local
!
! Enter the following command if you are doing Xauth remotely via RADIUS.
!aaa authentication login radius_xauth group radius
!
! Enter the following command if you are not doing Xauth.
!aaa authentication login no_xauth none
!
! Enter the following command if you are doing local group authentication.
aaa authorization network local_auth local 
!
! Enter the following command if you are doing group authentication remotely via RADIUS.
!aaa authorization network radius_auth group radius 
!
! 
! Enter the following command if you are doing Xauth remotely via RADIUS.
!aaa accounting network radius_accounting start-stop group radius
aaa session-id common
ip subnet-zero
!
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
!       
! Enter the following commands if you are doing group authentication locally. 
crypto isakmp client configuration group unity
 key cisco123
 domain cisco.com
 pool client-address-pool
!         
!         
crypto ipsec transform-set trans1 esp-3des esp-sha-hmac
!
crypto dynamic-map to-remote-client 10
 set transform-set trans1 
 reverse-route remote-peer
!
!
! Use this map if you want to dolocal group authentication and Xauth.
crypto map to_peer_outside_local_xauth client authentication list local_xauth
crypto map to_peer_outside_local_xauth isakmp authorization list local_auth
crypto map to_peer_outside_local_xauth client configuration address respond
crypto map to_peer_outside_local_xauth 10 ipsec-isakmp dynamic to-remote-client 
!
! Use this map if you want to use Radius for group authentication and Xauth.
!crypto map to_peer_outside_radius_xauth isakmp client authentication list radius_xauth
!crypto map to_peer_outside_radius_xauth client accounting list radius_accounting
!crypto map to_peer_outside_radius_xauth isakmp authorization list radius_auth
!crypto map to_peer_outside_radius_xauth isakmp client configuration address respond
!crypto map to_peer_outside_radius_xauth isakmp 10 ipsec-isakmp dynamic to-remote-client 
!
!
! Use this map if you want to do local authentication and no Xauth.
!crypto map to_peer_outside_no_xauth isakmp authorization list local_auth
!crypto map to_peer_outside_no_xauth configuration address respond
!crypto map to_peer_outside_no_xauth 10 ipsec-isakmp dynamic to-remote-client 
!
interface Ethernet0/0
 ip address 209.165.201.2 255.255.255.224
 standby 1 ip 209.165.201.3
 standby 1 preempt
 standby 1 name HA-out
 standby 1 track Ethernet1/0
 standby delay reload
 crypto map to_peer_outside_local_xauth redundancy HA-out stateful
!
interface Ethernet1/0
 ip address 10.0.0.2 255.255.255.0
 standby 2 ip 10.0.0.3
 standby 2 preempt
 standby 2 name HA-out
 standby 2 track Ethernet0/0
 standby delay reload
!
! Enable loopback0 if you are using radius for Xauth, group auth, or accounting with 
! crypto HA
!interface loopback0
! ip address 192.168.100.1 255.255.255.255
!
! Enable this command if you are using radius for Xauth, group auth, or accounting with 
! crypto HA
!ip radius source-interface loopback0
!
ip local pool client-address-pool 50.0.0.1 50.0.0.254 
ip classless
ip route 0.0.0.0 0.0.0.0 209.165.201.5
ip route 192.168.0.0 255.255.0.0
!
radius-server host 192.168.0.200 auth-port 1845 acct-port 1846
radius-server key radius123
!
control-plane
!         
!         
!         
line con 0
 exec-timeout 0 0
line aux 0
line vty 0 4
!         
end
Additional References

The following sections provide references related to stateful failover for IPSec.

Related Documents

Related Topic

Document Title

RRI

IPSec VPN High Availability Enhancements, Cisco IOS Release 12.2(11)T feature module

HSRP

The section "Configuring the Hot Standby Router Protocol" within the chapter "Configuring IP Services" of the Cisco IOS IP Configuration Guide, Release 12.3

Easy VPN Server

Cisco Easy VPN Remote, Cisco IOS Release 12.3(7)T feature module

IPSec and IKE configuration

The section "IP Security and Encryption" in the Cisco IOS Security Configuration Guide, Release 12.3

IPSec and IKE commands

Cisco IOS Security Command Reference, Release 12.3 T

Standards

Standards

Title

None

—

MIBs

MIBs

MIBs Link

None

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

RFCs

RFCs

Title

None

—

Technical Assistance

Description

Link

Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.

http://www.cisco.com/public/support/tac/home.shtml

Command Reference

This section documents only new and modified commands.

New Commands

•crypto map redundancy replay-interval

•debug crypto ha

•debug crypto ipsec ha

•debug crypto isakmp ha

•local-ip (IPC transport-SCTP local)

•local-port

•redundancy inter-device

•redundancy stateful

•remote-ip (IPC transport-SCTP remote)

•remote-port

•scheme

•security ipsec

•show crypto ha

Modified Commands

•clear crypto isakmp

•clear crypto sa

•clear crypto session

•crypto map (interface IPSec)

•show crypto ipsec sa

•show crypto isakmp sa

•show crypto session

•show redundancy

clear crypto isakmp

To clear active Internet Key Exchange (IKE) connections, use the clear crypto isakmp command in privileged EXEC mode.

clear crypto isakmp [connection-id] [active | standby]
Syntax Description

connection-id

(Optional) ID of the connection that is to be cleared. If this argument is not used, all existing connections will be cleared.

active

(Optional) Clears only IKE security associations (SAs) in the active state. For each active SA that is cleared, the standby router will be notified to clear the corresponding standby SA.

standby

(Optional) Clears only IKE SAs in the standby (secondary) state.

Note If the router is in standby mode, the router will immediately resynchronize the standby SAs; thus, it may appear as though the standby SAs were not cleared.

Command Modes

Privileged EXEC

Command History

Release

Modification

11.3 T

This command was introduced.

12.3(11)T

The active and standby keywords were added.

Usage Guidelines

Caution If the connection-id argument is not used, all existing IKE connections will be cleared when this command is issued.

Examples

The following example clears an IKE connection between two peers connected by interfaces 172.21.114.123 and 172.21.114.67:
Router# show crypto isakmp sa
    dst           src          state        conn-id   slot
172.21.114.123 172.21.114.67  QM_IDLE           1       0
209.165.201.1  209.165.201.2  QM_IDLE           8       0
Router# clear crypto isakmp 1
Router# show crypto isakmp sa
    dst           src          state        conn-id   slot
209.165.201.1  209.165.201.2  QM_IDLE           8       0
Router#
Related Commands

Command

Description

show crypto isakmp sa

Displays current IKE SAs.

clear crypto sa

To delete IP Security (IPSec) security associations (SAs), use the clear crypto sa command in privileged EXEC mode.

clear crypto sa [active | standby]
Virtual Routing and Forwarding (VRF) Syntax

clear crypto sa peer [vrf fvrf-name] address
clear crypto sa [vrf ivrf-name]
Crypto Map Syntax

clear crypto sa map map-name
IP Address, Security Protocol Standard, and SPI Syntax

clear crypto sa entry destination-address protocol spi
Traffic Counters Syntax

clear crypto sa counters
Syntax Description

active

(Optional) Clears only IPSec SAs that are in the active state.

standby

(Optional) Clears only IPSec SAs that are in the standby state.

Note If the router is in standby mode, the router will immediately resynchronize the standby SAs; thus, it may appear as though the standby SAs were not cleared.

peer [vrf fvrf-name] address

Deletes any IPSec SAs for the specified peer. The fvrf-name argument specifies the front door VRF (FVRF) of the peer address.

vrf ivrf-name

(Optional) Clears all IPSec SAs whose inside virtual routing and forwarding (IVRF) is the same as the ivrf-name.

map

Deletes any IPSec SAs for the named crypto map set.

map-name

Specifies the name of a crypto map set.

entry

Deletes the IPSec SA with the specified address, protocol, and security parameter index (SPI).

destination-address

Specifies the IP address of the remote peer.

protocol

Specifies either the Encapsulation Security Protocol (ESP) or Authentication Header (AH).

spi

Specifies an SPI (found by displaying the SA database).

counters

Clears the traffic counters maintained for each SA; the counters keyword does not clear the SAs themselves.

Command Modes

Privileged EXEC

Command History

Release

Modification

11.3 T

This command was introduced.

12.2(15)T

The vrf keyword and fvrf-name argument for clear crypto sa peer were added. The vrf keyword and ivrf-name argument for clear crypto sa were added.

12.3(11)T

The active and standby keywords were added.

Usage Guidelines

This command clears (deletes) IPSec SAs.

If the SAs were established via Internet Key Exchange (IKE), they are deleted and future IPSec traffic will require new SAs to be negotiated. (When IKE is used, the IPSec SAs are established only when needed.)

If the SAs are manually established, the SAs are deleted and reinstalled. (When IKE is not used, the IPSec SAs are created as soon as the configuration is completed.)

Note If the peer, map, entry, counters, active, or standby keywords are not used, all IPSec SAs will be deleted.

•The peer keyword deletes any IPSec SAs for the specified peer.

•The map keyword deletes any IPSec SAs for the named crypto map set.

•The entry keyword deletes the IPSec SA with the specified address, protocol, and SPI.

•The active and standby keywords delete the IPSec SAs in the active or standby state, respectively.

If any of the above commands cause a particular SA to be deleted, all the "sibling" SAs—that were established during the same IKE negotiation—are deleted as well.

The counters keyword simply clears the traffic counters maintained for each SA; it does not clear the SAs themselves.

If you make configuration changes that affect SAs, these changes will not apply to existing SAs but to negotiations for subsequent SAs. You can use the clear crypto sa command to restart all SAs so that they will use the most current configuration settings. In the case of manually established SAs, if you make changes that affect SAs you must use the clear crypto sa command before the changes take effect.

If the router is processing active IPSec traffic, it is suggested that you clear only the portion of the SA database that is affected by the changes, to avoid causing active IPSec traffic to temporarily fail.

Note that this command clears only IPSec SAs; to clear IKE state, use the clear crypto isakmp command.

Examples

The following example clears (and reinitializes if appropriate) all IPSec SAs at the router:
clear crypto sa
The following example clears (and reinitializes if appropriate) the inbound and outbound IPSec SAs established, along with the SA established for address 10.0.0.1 using the AH protocol with the SPI of 256:
clear crypto sa entry 10.0.0.1 AH 256
The following example clears all the SAs for VRF VPN1:
clear crypto sa vrf vpn1
Related Commands

Command

Description

clear crypto isakmp

Clears active IKE connections.

clear crypto session

To delete crypto sessions (IP Security [IPSec] and Internet Key Exchange [IKE] security associations [SAs]), use the clear crypto session command in privileged EXEC mode.

clear crypto session [local ip-address [port local-port]] [remote ip-address [port remote-port]] | [fvrf vrf-name] [ivrf vrf-name]
IPSec and IKE Stateful Failover Syntax

clear crypto session [active | standby]
Syntax Description

local ip-address

(Optional) Clears crypto sessions for a local crypto endpoint.

•The ip-address is the IP address of the local crypto endpoint.

port local-port

(Optional) IKE port of the local endpoint. The local-port value can be 1 through 65535. The default value is 500.

remote ip-address

(Optional) Clears crypto sessions for a remote IKE peer.

•The ip-address is the IP address of the remote IKE peer.

port remote-port

(Optional) IKE port of the remote endpoint to be deleted. The remote-port value can be from 1 through 65535. The default value is 500.

fvrf vrf-name

(Optional) Specifies the front door virtual routing and forwarding (FVRF) session that is to be cleared.

ivrf vrf-name

(Optional) Specifies the inside VRF (IVRF) session that is to be cleared.

active

(Optional) Clears only IPSec and IKE SAs in the active state.

standby

(Optional) Clears only IPSec and IKE SAs in the standby state.

Note If the router is in standby mode, the router will immediately resynchronize the standby SAs with the active router.

Defaults

If the clear crypto session command is entered without any keywords, all existing sessions will be deleted. The IPSec SAs will be deleted first, then the IKE SAs. Port default values are 500.

Command Modes

Privileged EXEC

Command History

Release

Modification

12.3(4)T

This command was introduced.

12.3(11)T

The active and standby keywords were added.

Usage Guidelines

To clear a specific crypto session or a subset of all the sessions, you need to provide session-specific parameters, such as a local or remote IP address, a local or remote port, an FVRF name, or an IVRF name.

If a local IP address is provided as a parameter when you use the clear crypto session command, all the sessions (and their IKE SAs and IPSec SAs) that share the IP address as a local crypto endpoint (IKE local address) will be deleted.

Examples

The following example shows that all crypto sessions will be deleted:
Router# clear crypto session
The following example shows that the crypto session of the FVRF named "blue" will be deleted:
Router# clear crypto session fvrf blue
The following example shows that the crypto sessions of the FVRF "blue" and the IVRF session "green" will be deleted:
Router# clear crypto session fvrf blue ivrf green
The following example shows that the crypto sessions of the local endpoint 10.1.1.1 and remote endpoint 10.2.2.2 will be deleted. The local endpoint port is 5, and the remote endpoint port is 10.
Router# clear crypto session local 10.1.1.1 port 5 remote 10.2.2.2 port 10=
Related Commands

Command

Description

description

Adds a description for an IKE peer.

show crypto isakmp peer

Displays peer descriptions.

show crypto session

Displays status information for active crypto sessions in a router.

crypto map (interface IPSec)

To apply a previously defined crypto map set to an interface, use the crypto map command in interface configuration mode. To remove the crypto map set from the interface, use the no form of this command.

crypto map map-name [redundancy standby-group-name[stateful]]
no crypto map [map-name] [redundancy standby-group-name [stateful]]
Syntax Description

map-name

Name that identifies the crypto map set. This is the name assigned when the crypto map was created.

When the no form of the command is used, this argument is optional. Any value supplied for the argument is ignored.

redundancy

(Optional) Defines a backup IP Security (IPSec) peer. Both routers in the standby group are defined by the redundancy standby name and share the same virtual IP address.

standby-group-name

(Optional) Refers to the name of the standby group as defined by Hot Standby Router Protocol (HSRP) standby commands.

stateful

(Optional) Enables IPSec stateful failover for the crypto map.

Defaults

No crypto maps are assigned to interfaces.

Command Modes

Interface configuration

Command History

Release

Modification

11.2

This command was introduced.

12.1(9)E

The redundancy keyword and standby-name argument were added.

12.2(8)T

The redundancy keyword and standby-name argument were integrated into Cisco IOS Release 12.2(8)T.

12.2(11)T

This command was implemented on the Cisco AS5300 and Cisco AS5800 platforms.

12.3(11)T

The stateful keyword was added.

Usage Guidelines

Use this command to assign a crypto map set to an interface. You must assign a crypto map set to an interface before that interface can provide IPSec services. Only one crypto map set can be assigned to an interface. If multiple crypto map entries have the same map name but a different sequence number, they are considered to be part of the same set and will all be applied to the interface. The crypto map entry that has the lowest sequence number is considered the highest priority and will be evaluated first. A single crypto map set can contain a combination of ipsec-isakmp and ipsec-manual crypto map entries.

The standby name must be configured on all devices in the standby group, and the standby address must be configured on at least one member of the group. If the standby name is removed from the router, the IPSec security associations (SAs) will be deleted. If the standby name is added again, regardless of whether the same name or a different name is used, the crypto map (using the redundancy option) will have to be reapplied to the interface.

Note A virtual IP address must be configured in the standby group to enable either stateless or stateful redundancy.

The stateful keyword enables stateful failover of IKE and IPSec sessions. Stateful Switch Over (SSO) must also be configured for IPSec stateful failover to operate correctly.

Examples

The following example shows how all remote Virtual Private Network (VPN) gateways connect to the router via 192.168.0.3:
crypto map mymap 1 ipsec-isakmp
 set peer 10.1.1.1
 reverse-route
 set transform-set esp-3des-sha
 match address 102
Interface FastEthernet 0/0
 ip address 192.168.0.2 255.255.255.0
 standby name group1
 standby ip 192.168.0.3
 crypto map mymap redundancy group1
access-list 102 permit ip 192.168.1.0 0.0.0.255 10.0.0.0 0.0.255.255
The crypto map on the interface binds this standby address as the local tunnel endpoint for all instances of "mymap" and, at the same time, ensures that stateless HSRP failover is facilitated between an active and standby device that belongs to the same standby group, "group1."

Reverse route injection (RRI) is also enabled to provide the ability for only the active device in the HSRP group to be advertising itself to inside devices as the next hop VPN gateway to the remote proxies. If a failover occurs, routes are deleted on the former active device and created on the new active device.

The following example shows how to configure IPSec stateful failover on the crypto map "to-peer-outside":
crypto map to-peer-outside 10 ipsec-isakmp 
 set peer 209.165.200.225
 set transform-set trans1 
 match address peer-outside
interface Ethernet0/0
 ip address 209.165.201.1 255.255.255.224
 standby 1 ip 209.165.201.3
 standby 1 preempt
 standby 1 name HA-out
 standby 1 track Ethernet1/0
crypto map to-peer-outside redundancy HA-out stateful

Related Commands

Command

Description

crypto map (global IPSec)

Creates or modifies a crypto map entry and enters the crypto map configuration mode.

crypto map local-address

Specifies and names an identifying interface to be used by the crypto map for IPSec traffic.

redundancy inter-device

Configures redundancy and enters inter-device configuration mode.

show crypto map (IPSec)

Displays the crypto map configuration.

standby ip

Assigns an IP address that is to be shared among the members of the HSRP group and owned by the primary IP address.

standby name

Assigns a user-defined group name to the HSRP redundancy group.

crypto map redundancy replay-interval

To modify the interval at which inbound and outbound replay updates are passed from an active device to a standby device, use the crypto map redundancy replay-interval command in global configuration mode. To return to the default functionality, use the no form of this command.

crypto map map-name redundancy replay-interval inbound in-value outbound out-value
no crypto map map-name redundancy replay-interval inbound in-value outbound out-value
Syntax Description

map-name

Name that identifies the crypto map set. This is the name assigned when the crypto map was created.

inbound in-value

Number of inbound packets that are processed before an anti-replay update is sent from the active router to the standby router.

outbound out-value

Number of outbound packets that are processed before an anti-replay update is sent from the active router to the standby router.

Defaults

inbound in-value: one update every 1,000 packets

outbound out-value: one update every 100,000 packets

Command Modes

Global configuration

Command History

Release

Modification

12.3(11)T

This command was introduced.

Usage Guidelines

Note This command can be used only in conjunction with IPSec stateful failover on a crypto map.

Stateful failover enables a router to continue processing and forwarding packets after a planned or unplanned outage occurs; that is, a backup (secondary) router automatically takes over the tasks of the active (primary) router if the active router loses connectivity for any reason.

The crypto map redundancy replay-interval command allows you to modify the interval in which an IP redundancy-enabled crypto map sends anti-replay updates from the active router to the standby router.

Examples

The following example shows how to enable replay checking for the crypto map "to-peer-outside" and enable IPSec stateful failover:
crypto map to-peer-outside redundancy replay-interval inbound 1000 outbound 10000
crypto map to-peer-outside 10 ipsec-isakmp 
 set peer 209.165.200.225
 set transform-set trans1 
 match address peer-outside
!
interface Ethernet0/0
 ip address 209.165.201.1 255.255.255.224
 standby 1 ip 209.165.201.3
 standby 1 preempt
 standby 1 name HA-out
 standby 1 track Ethernet1/0
crypto map to-peer-outside redundancy HA-out stateful

debug crypto ha

To display crypto high availability debugging information, use the debug crypto ha command in privileged EXEC mode. To disable debugging messages, use the no form of this command.

debug crypto ha
no debug crypto ha
Syntax Description

This command has no arguments or keywords.

Command Modes

Privileged EXEC

Command History

Release

Modification

12.3(11)T

This command was introduced.

Examples

The following example is sample output from the debug crypto ha command:
Router# debug crypto ha 
Active router:
Router# show debug
Cryptographic Subsystem:
  Crypto High Availability Manager debugging is on
vrf-lite-R1#
*Sep 28 21:27:50.899:Sending IKE Add SA Message
*Sep 28 21:27:50.899:HA Message 0:flags=0x01 len=394 HA_IKE_MSG_ADD_SA (2)
*Sep 28 21:27:50.899:  ID:04000003
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_MY_COOKIE (2) len 8
*Sep 28 21:27:50.899:   9B 1A 76 AA 99 11 1A 1F 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_HIS_COOKIE (3) len 8
*Sep 28 21:27:50.899:   E2 A2 A3 5F 53 1D EA 15 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_SRC (4) len 4
*Sep 28 21:27:50.899:   04 00 00 05 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_DST (5) len 4
*Sep 28 21:27:50.899:   04 00 00 03 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_PEER_PORT (6) len 2
*Sep 28 21:27:50.899:   01 F4 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_F_VRF (7) len 1
*Sep 28 21:27:50.899:   00 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_INIT_OR_RESP (8) len 1
*Sep 28 21:27:50.899:   00 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_NAT_DISCOVERY (9) len 1
*Sep 28 21:27:50.899:   02 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_IDTYPE (38) len 1
*Sep 28 21:27:50.899:   01 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_PROTOCOL (39) len 1
*Sep 28 21:27:50.899:   11 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_PORT (40) len 2
*Sep 28 21:27:50.899:   01 F4 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_ADDR (41) len 4
*Sep 28 21:27:50.899:   04 00 00 05 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_MASK (42) len 4
*Sep 28 21:27:50.899:   00 00 00 00 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_ID_STR (44) len 4
*Sep 28 21:27:50.899:   00 00 00 00 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_PEERS_CAPABILITIES (11) len 4
*Sep 28 21:27:50.899:   00 00 07 7F 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_MY_CAPABILITIES (12) len 4
*Sep 28 21:27:50.899:   00 00 07 7F 
*Sep 28 21:27:50.899:  attr HA_IKE_ATT_STATE_MASK (13) len 4
*Sep 28 21:27:50.899:   00 00 27 FF 
.
.
.
Related Commands

Command

Description

debug crypto ipsec ha

Enables debugging messages for IPSec high availability.

debug crypto isakmp ha

Enables debugging messages for ISAKMP high availability.

debug crypto ipsec ha

To enable debugging messages for IP Security (IPSec) high availability, use the debug crypto ipsec ha command in privileged EXEC mode. To disable debugging messages, use the no form of this command.

debug crypto ipsec ha [detail | update]
no debug crypto ipsec ha [detail | update]
Syntax Description

detail

(Optional) Displays detailed debug information.

update

(Optional) Displays updates for inbound and outbound related data.

Command Modes

Privileged EXEC

Command History

Release

Modification

12.3(11)T

This command was introduced.

Examples

The following example is sample output of the debug crypto ipsec ha command for both the active and stanby router:
Active Router
Router# debug crypto ipsec ha 
Crypto IPSEC High Availability debugging is on
*Sep 29 17:03:01.851:IPSec HA (crypto_ha_ipsec_notify_add_sa):called
*Sep 29 17:03:01.851:IPSec HA (crypto_ha_ipsec_notify_add_sa):New IPsec SA added... 
notifying HA Mgr
Standby Router
Router# debug crypto ipsec ha 
Crypto IPSEC High Availability debugging is on
vrf-lite-R1#
*Sep 29 17:03:01.031:IPSec HA (crypto_ha_ipsec_mgr_recv_add_sas):HA mgr wants to insert 
the following bundle
*Sep 29 17:03:01.031:IPSec HA (crypto_ha_ipsec_mgr_recv_add_sas):This SA Supports DPD
*Sep 29 17:03:01.031:IPSec HA (crypto_ha_ipsec_gen_sa):Sending Kei to IPSec num_kei 2
*Sep 29 17:03:01.039:IPSec HA (crypto_ha_ipsec_notify_add_sa):called
*Sep 29 17:03:01.039:IPSec HA (crypto_ha_ipsec_notify_add_sa):operation not performed as 
standby ip 4.0.0.3
The following example is sample debug output with the detail keyword:
Active Router
*Sep 29 17:05:48.803:IPSec HA (crypto_ha_ipsec_mgr_set_state_common):called for vip 
4.0.0.3
*Sep 29 17:06:11.655:IPSec HA (crypto_ha_ipsec_mgr_bulk_sync_sas):Bulk sync request from 
standby for local addr 4.0.0.3
*Sep 29 17:06:44.059:IPSec HA (crypto_ha_ipsec_notify_add_sa):called
*Sep 29 17:06:44.059:IPSec HA (crypto_ha_ipsec_notify_add_sa):New IPsec SA added... 
notifying HA Mgr
Standby Router
Router# debug crypto ipsec ha detail 
Crypto IPSEC High Availability Detail debugging is on
vrf-lite-R1#
*Sep 29 17:06:44.063:IPSec HA (crypto_ha_ipsec_mgr_recv_add_sas):HA mgr wants to insert 
the following bundle
*Sep 29 17:06:44.063:IPSec HA (crypto_ha_ipsec_mgr_recv_add_sas):This SA Supports DPD
*Sep 29 17:06:44.063:IPSec HA (crypto_ha_ipsec_gen_sa):Sending Kei to IPSec num_kei 2
*Sep 29 17:06:44.071:IPSec HA (crypto_ha_ipsec_notify_add_sa):called
*Sep 29 17:06:44.071:IPSec HA (crypto_ha_ipsec_notify_add_sa):operation not performed as 
standby ip 4.0.0.3
The following example is sample debug output with the update keyword:
Active Router
*Sep 29 17:27:30.839:IPSec HA(check_and_send_replay_update):Replay triggered update 
seq_num 1000 last-sent 0 dir inbound
*Sep 29 17:27:30.839:IPSec HA(create_update_struct):Sending inbound update
*Sep 29 17:27:30.839:IPSec HA(send_update_struct):
        Outbound - New KB 0, New replay 0
        Inbound - New KB 3998772, New replay 1000
*Sep 29 17:29:30.883:IPSec HA(check_and_send_replay_update):Replay triggered update 
seq_num 2000 last-sent 1000 dir inbound
*Sep 29 17:29:30.883:IPSec HA(create_update_struct):Sending inbound update
*Sep 29 17:29:30.883:IPSec HA(send_update_struct):
        Outbound - New KB 0, New replay 0
        Inbound - New KB 3998624, New replay 2000
*Sep 29 17:30:30.899:IPSec HA(check_and_send_replay_update):Replay triggered update 
seq_num 3000 last-sent 2000 dir inbound
*Sep 29 17:30:30.899:IPSec HA(create_update_struct):Sending inbound update
*Sep 29 17:30:30.899:IPSec HA(send_update_struct):
        Outbound - New KB 0, New replay 0
        Inbound - New KB 3998476, New replay 3000
*Sep 29 17:32:30.943:IPSec HA(check_and_send_replay_update):Replay triggered update 
seq_num 4000 last-sent 3000 dir inbound
*Sep 29 17:32:30.943:IPSec HA(create_update_struct):Sending inbound update
*Sep 29 17:32:30.943:IPSec HA(send_update_struct):
        Outbound - New KB 0, New replay 0
        Inbound - New KB 3998327, New replay 4000
Standby Router
*Sep 29 17:27:28.887:IPSec HA(crypto_ha_ipsec_mgr_recv_update_sa):called
*Sep 29 17:27:28.887:IPSec HA(crypto_ha_ipsec_mgr_recv_update_sa):UPDATING INBOUND SA:ip = 
4.0.0.3, protocol = 50, spi = B8A47EC9,
        NEW KB LIFE = 3998772,
        NEW REPLAY WINDOW START = 1000,
*Sep 29 17:29:28.915:IPSec HA(crypto_ha_ipsec_mgr_recv_update_sa):called
*Sep 29 17:29:28.915:IPSec HA(crypto_ha_ipsec_mgr_recv_update_sa):UPDATING INBOUND SA:ip = 
4.0.0.3, protocol = 50, spi = B8A47EC9,
        NEW KB LIFE = 3998624,
        NEW REPLAY WINDOW START = 2000,
*Sep 29 17:30:28.939:IPSec HA(crypto_ha_ipsec_mgr_recv_update_sa):called
*Sep 29 17:30:28.939:IPSec HA(crypto_ha_ipsec_mgr_recv_update_sa):UPDATING INBOUND SA:ip = 
4.0.0.3, protocol = 50, spi = B8A47EC9,
        NEW KB LIFE = 3998476,
        NEW REPLAY WINDOW START = 3000,
*Sep 29 17:32:28.955:IPSec HA(crypto_ha_ipsec_mgr_recv_update_sa):called
*Sep 29 17:32:28.955:IPSec HA(crypto_ha_ipsec_mgr_recv_update_sa):UPDATING INBOUND SA:ip = 
4.0.0.3, protocol = 50, spi = B8A47EC9,
        NEW KB LIFE = 3998327,
        NEW REPLAY WINDOW START = 4000,
Related Commands

Command

Description

debug crypto ha

Displays crypto high availability debugging information.

debug crypto isakmp ha

Enables debugging messages for ISAKMP high availability.

debug crypto isakmp ha

To enable debugging messages for Internet Security Association and Key Management Protocol (ISAKMP) high availability, use the debug crypto isakmp ha command in privileged EXEC mode. To disable debugging messages, use the no form of this command.

debug crypto isakmp ha [detail]
no debug crypto isakmp ha [detail]
Syntax Description

detail

(Optional) Displays detailed debug information.

Command Modes

Privileged EXEC

Command History

Release

Modification

12.3(11)T

This command was introduced.

Examples

The following example is sample output for a standby router from the debug crypto isakmp ha command:
Active Router 
no debug message
Standby Router
Router# debug crypto isakmp ha
Crypto ISAKMP High Availability debugging is on
vrf-lite-R1#
*Sep 28 21:54:41.815:IKE HA:(4.0.0.3) Adding STANDBY IKE SA
*Sep 28 21:54:41.843:IKE HA:Create peer struct for local 4.0.0.3 remote 4.0.0.5 & locked
*Sep 28 21:54:41.843:IKE HA:IKE SA inserted on standby with src = 4.0.0.5, dst = 4.0.0.3
The following example is displayed when the detail keyword is issued. (Note that debug output without issuing the detail keyword is the same as the debug output with detail keyword.)
Active Router
Router# debug crypto isakmp ha detail 
Crypto ISAKMP High Availability detailed debugging is on
vrf-lite-R1#
*Sep 29 16:59:15.035:IKE HA:IKE SA is already failed over
Standby Router 
Router# debug crypto isakmp ha detail 
Crypto ISAKMP High Availability detailed debugging is on
vrf-lite-R2#
*Sep 29 16:59:14.371:IKE HA:(4.0.0.3) Adding STANDBY IKE SA
*Sep 29 16:59:14.411:IKE HA:Create peer struct for local 4.0.0.3 remote 4.0.0.5 & locked
*Sep 29 16:59:14.411:IKE HA:IKE SA inserted on standby with src = 4.0.0.5, dst = 4.0.0.3
Related Commands

Command

Description

debug crypto ha

Displays crypto high availability debugging information.

debug crypto ipsec ha

Enables debugging messages for IPSec high availability.

local-ip (IPC transport-SCTP local)

To define at least one local IP address that is used to communicate with the local peer, use the local-ip command in IPC transport-SCTP local configuration mode. To remove one or all IP addresses from your configuration, use the no form of this command.

local-ip device-real-ip-address [device-real-ip-address2]
no local-ip device-real-ip-address [device-real-ip-address2]
Syntax Description

device-real-ip-address

IP address of the local device.

The local IP addresses must match the remote IP addresses on the peer router. There can be either one or two IP addresses, which must be in global Virtual Routing and Forwarding (VRF). A virtual IP (VIP) address cannot be used.

device-real-ip-address2

(Optional) IP address of the local device.

Defaults

No IP addresses are defined; thus, peers cannot communicate with the local peer.

Command Modes

IPC transport-SCTP local configuration

Command History

Release

Modification

12.3(8)T

This command was introduced.

Usage Guidelines

Use the local-ip command to help associate Stream Control Transmission Protocol (SCTP) as the transport protocol between the local and remote peer.

This command is part of a suite of commands used to configure the Stateful Switchover (SSO) protocol. SSO is necessary for IP Security (IPSec) and Internet Key Exchange (IKE) to learn about the redundancy state of the network and to synchronize their internal application state with their redundant peers.

Examples

The following example shows how to enable SSO:
!
redundancy inter-device
 scheme standby HA-in
!
!
ipc zone default
 association 1
  no shutdown
  protocol sctp
   local-port 5000
    local-ip 10.0.0.1
   remote-port 5000
    remote-ip 10.0.0.2
Related Commands

Command

Description

local-port

Defines the local SCTP port number that is used to communicate with the redundant peer.

remote-ip

Defines at least one remote IP address that is used to communicate with the redundant peer.

local-port

To define the local Stream Control Transmission Protocol (SCTP) port that is used to communicate with the redundant peer, use the local-port command in SCTP protocol configuration mode. .

local-port local-port-number
Syntax Description

local-port-number

Local port number, which should be the same as the remote port number on the peer router (which is specified via the remote-port command).

Defaults

A local SCTP port is not defined.

Command Modes

SCTP protocol configuration

Command History

Release

Modification

12.3(8)T

This command was introduced.

Usage Guidelines

The local-port command enters IPC transport-SCTP local configuration mode, which allows you to specify at least one local IP address (via the local-ip command) that is used to communicate with the redundant peer.

Examples

The following example shows how to enable Stateful Switchover (SSO):
!
redundancy inter-device
 scheme standby HA-in
!
!
ipc zone default
 association 1
  no shutdown
  protocol sctp
   local-port 5000
    local-ip 10.0.0.1
   remote-port 5000
    remote-ip 10.0.0.2
Related Commands

Command

Description

local-ip

Defines at least one local IP address that is used to communicate with the local peer.

remote-port

Defines the remote SCTP that is used to communicate with the redundant peer.

redundancy inter-device

To enter inter-device configuration mode, use the redundancy inter-device command in global configuration mode. To exit inter-device configuration mode, use the exit command. To remove all inter-device configuration, use the no form of this command.

redundancy inter-device
no redundancy inter-device
Syntax Description

This command has no arguments or keywords.

Defaults

If this command is not enabled, you cannot configure stateful failover for IPSec.

Command Modes

Global configuration

Command History

Release

Modification

12.3(8)T

This command was introduced.

Usage Guidelines

Use the redundancy inter-device command to enter inter-device configuration mode, which allows you to enable and protect Stateful Switchover (SSO) traffic.

Examples

The following example shows how to issue the redundancy inter-device command when enabling SSO:
redundancy inter-device
 scheme standby HA-in
!
!
ipc zone default
 association 1
  no shutdown
  protocol sctp
   local-port 5000
    local-ip 10.0.0.1
   remote-port 5000
    remote-ip 10.0.0.2
!
The following example shows how to issue the redundancy inter-device command when configuring SSO traffic protection:
crypto ipsec transform-set trans2 ah-md5-hmac esp-aes 
!         
crypto ipsec profile sso-secure
 set transform-set trans2 
!
redundancy inter-device
 scheme standby HA-in
 security ipsec sso-secure
Related Commands

Command

Description

local-ip

Defines at least one local IP address that is used to communicate with the redundant peer.

local-port

Defines the local SCTP that is used to communicate with the redundant peer.

remote-ip

Defines at least one IP address of the redundant peer that is used to communicate with the local device.

remote-port

Defines the remote SCTP that is used to communicate with the redundant peer.

scheme

Defines that redundancy scheme that is used between two devices.

redundancy stateful

To configure stateful failover for tunnels using IP Security (IPSec), use the redundancy stateful command in crypto map configuration mode. To disable stateful failover for tunnel protection, use the no form of this command.

redundancy standby-group-name stateful
no redundancy standby-group-name stateful
Syntax Description

standby-group-name

Refers to the name of the standby group as defined by Hot Standby Router Protocol (HSRP) standby commands. Both routers in the standby group are defined by this argument and share the same virtual IP (VIP) address.

Defaults

Stateful failover is not enabled for IPSec tunnels.

Command Modes

Crypto map configuration

Command History

Release

Modification

12.3(11)T

This command was introduced.

Usage Guidelines

The redundancy stateful command uses an existing IPSec profile (which is specified via the crypto ipsec profile command) to configure IPSec stateful failover for tunnel protection. (You do not configure the tunnel interface as you would with a crypto map configuration.) IPSec stateful failover enables you to define a backup IPSec peer (secondary) to take over the tasks of the active (primary) router if the active router is deemed unavailable.

The tunnel source address must be a VIP address, and it must not be an interface name.

Examples

The following example shows how to configure stateful failover for tunnel protection:
crypto ipsec profile peer-profile
  redundancy HA-out stateful
interface Tunnel1
 ip unnumbered Loopback0
 tunnel source 209.165.201.3
 tunnel destination 10.0.0.5
 tunnel protection ipsec profile peer-profile
!
interface Ethernet0/0
 ip address 209.165.201.1 255.255.255.224
 standby 1 ip 209.165.201.3
 standby 1 name HA-out
Related Commands

Command

Description

crypto ipsec profile

Defines the IPSec parameters that are to be used for IPSec encryption between two routers and enters crypto map configuration mode.

remote-ip (IPC transport-SCTP remote)

To define at least one IP address of the redundant peer that is used to communicate with the local device, use the remote-ip command in IPC transport-SCTP remote configuration mode. To remove one or all IP addresses from your configuration, use the no form of this command.

remote-ip peer-real-ip-address [peer-real-ip-address2]
no remote-ip peer-real-ip-address [peer-real-ip-address2]
Syntax Description

peer-real-ip-address

IP address of the remote peer.

The remote IP addresses must match the local IP addresses on the peer router. There can be either one or two IP addresses, which must be in the global Virtual Routing and Forwarding (VRF). A virtual IP (VIP) address cannot be used.

peer-real-ip-address2

(Optional) IP address of the remote peer.

Defaults

No IP addresses are defined.

Command Modes

IPC transport-SCTP remote configuration

Command History

Release

Modification

12.3(8)T

This command was introduced.

Usage Guidelines

Use the remote-ip command to help associate Stream Control Transmission Protocol (SCTP) as the transport protocol between the local and remote peer.

This command is part of a suite of commands used to configure the Stateful Switch Over (SSO) protocol. SSO is necessary for IP Security (IPSec) and Internet Key Exchange (IKE) to learn about the redundancy state of the network and to synchronize their internal application state with their redundant peers.

Examples

The following example shows how to enable SSO:
redundancy inter-device
 scheme standby HA-in
!
!
ipc zone default
 association 1
  no shutdown
  protocol sctp
   local-port 5000
    local-ip 10.0.0.1
   remote-port 5000
    remote-ip 10.0.0.2
Related Commands

Command

Description

local-ip

Defines at least one local IP address that is used to communicate with the local peer.

remote-port

Defines the remote SCTP that is used to communicate with the redundant peer.

remote-port

To define the remote Stream Control Transmission Protocol (SCTP) port that is used to communicate with the redundant peer, use the remote-port command in SCTP protocol configuration mode.

remote-port remote-port-number
Syntax Description

remote-port-number

Remote port number, which should be the same as the local port number on the peer router (which is specified via the local-port command).

Defaults

A remote SCTP port is not defined.

Command Modes

SCTP protocol configuration

Command History

Release

Modification

12.3(8)T

This command was introduced.

Usage Guidelines

The remote-port command enters IPC transport-SCTP remote configuration mode, which allows you to specify at least one remote IP address (via the remote-ip command) that is used to communicate with the redundant peer.

Examples

The following example shows how to enable Stateful Switchover (SSO):
redundancy inter-device
 scheme standby HA-in
!
!
ipc zone default
 association 1
  no shutdown
  protocol sctp
   local-port 5000
    local-ip 10.0.0.1
   remote-port 5000
    remote-ip 10.0.0.2
Related Commands

Command

Description

local-port

Defines the local SCTP port that is used to communicate with the redundant peer.

remote-ip

Defines at least one IP address of the redundant peer that is used to communicate with the local device.

scheme

To define the redundancy scheme that is used between two devices, use the scheme command in inter-device configuration mode. To disable the redundancy scheme, use the no form of this command.

scheme standby standby-group-name
no scheme standby standby-group-name
Syntax Description

standby

Redundancy scheme. Currently, the standby scheme is the only available scheme.

standby-group-name

Specifies the name of the standby group. This name must match the name that was specified via the standby name command. Also, the standby name should be the same on both the active and standby routers.

Defaults

A redundancy scheme is not specified.

Command Modes

Inter-device configuration

Command History

Release

Modification

12.3(8)T

This command was introduced.

Usage Guidelines

Only the active or standby state of the standby group is used for Stateful Switchover (SSO). The virtual IP (VIP) address of the standby group is not required or used by SSO. Also, the standby group does not have to be part of any crypto map configuration.

Examples

The following example shows how to enable SSO and define the standby scheme that is to be used by the active and standby devices:
redundancy inter-device
 scheme standby HA-in
!
!
ipc zone default
 association 1
  no shutdown
  protocol sctp
   local-port 5000
    local-ip 10.0.0.1
   remote-port 5000
    remote-ip 10.0.0.2
Related Commands

Command

Description

standby name

Configures the name of the standby group.

security ipsec

To apply a previously configured IP Security (IPSec) profile to the redundancy group communications, use the security ipsec command in inter-device configuration mode. To remove the IPSec profile from the configuration, use the no form of this command.

security ipsec profile-name
no security [ipsec [profile-name]]
Syntax Description

profile-name

Profile name, which was specified via the crypto ipsec profile command.

Defaults

The redundancy group is not secured.

Command Modes

Inter-device configuration

Command History

Release

Modification

12.3(11)T

This command was introduced.

Usage Guidelines

The security ipsec command allows you to secure a redundancy group via a previously configured IPSec profile. If you are certain that the Stateful Switchover (SSO) traffic between the redundancy group runs on a physically secure interface, you do not have to configure this command.

Note If you configure SSO traffic protection via the security ipsec command, the active and standby devices must be directly connected to each other via Ethernet networks.

Examples

The following example shows how to configure SSO traffic protection:
crypto ipsec transform-set trans2 ah-md5-hmac esp-aes 
!         
crypto ipsec profile sso-secure
 set transform-set trans2 
!
redundancy inter-device
 scheme standby HA-in
 security ipsec sso-secure
Related Commands

Command

Description

crypto ipsec profile

Defines the IPSec parameters that are to be used for IPSec encryption between two IPSec routers.

redundancy inter-device

Enters inter-device configuration mode.

show crypto ha

To display all virtual IP (VIP) addresses that are currently in use by IP Security (IPSec) and Internet Key Exchange (IKE), use the show crypto ha command in privileged EXEC mode.

show crypto ha
Syntax Description

This command has no arguments or keywords.

Command Modes

Privileged EXEC

Command History

Release

Modification

12.3(11)T

This command was introduced.

Examples

The following output from the show crypto ha command shows all VIP addresses that are being used by IPSec and IKE:
Router# show crypto ha
IKE VIP: 209.165.201.3
  stamp: 74 BA 70 27 9C 4F 7F 81 3A 70 13 C9 65 22 E7 76 
IKE VIP: 255.255.255.253
  stamp: Not set
IKE VIP: 255.255.255.254
  stamp: Not set
IPSec VIP: 209.165.201.3
IPSec VIP: 255.255.255.253
IPSec VIP: 255.255.255.254
show crypto ipsec sa

To display the settings used by current security associations (SAs), use the show crypto ipsec sa command in privileged EXEC mode.

show crypto ipsec sa [map map-name | address | identity | interface interface | peer [vrf fvrf-name] address | vrf ivrf-name] [detail]
IPSec and IKE Stateful Failover Syntax

show crypto ipsec sa [active | standby]
Syntax Description

map map-name

(Optional) Any existing SAs that were created for the crypto map set named map-name are displayed.

address

(Optional) All existing SAs are displayed, sorted by the destination address (either the local address or the address of the IP Security (IPSec) remote peer) and then by protocol (Authentication Header [AH] or Encapsulation Security Protocol [ESP]).

identity

(Optional) Only the flow information is displayed. It does not show the SA information.

interface interface

(Optional) All existing SAs created for an interface that is named interface are displayed.

peer [vrf fvrf-name] address

(Optional) All existing SAs with the peer address. If the peer address is in the Virtual Routing and Forwarding (VRF), specify vrf and the fvrf-name.

vrf ivrf-name

(Optional) All existing SAs whose inside virtual routing and forwarding (IVRF) is the same as the ivrf-name.

detail

(Optional) Detailed error counters are displayed. (The default is the high-level send or receive error counters.)

active

(Optional) All existing SAs that are in an active state are displayed.

standby

(Optional) All existing SAs that are in standby state are displayed.

Command Modes

Privileged EXEC

Command History

Release

Modification

11.3 T

This command was introduced.

12.2(13)T

The "remote crypto endpt" and "in use settings" fields were modified to support Network Address Translation (NAT) traversal.

12.2(15)T

The interface keyword and interface argument were added. The peer keyword, the vrf keyword, and the fvrf-name argument were added. In addition, the address keyword was added to the peer keyword string. The vrf keyword and ivrf-name argument were added.

12.3(11)T

The active and standby keywords were added.

Usage Guidelines

If no keyword is used, all SAs are displayed. They are sorted first by interface, and then by traffic flow (for example, source or destination address, mask, protocol, or port). Within a flow, the SAs are listed by protocol (ESP or AH) and direction (inbound or outbound).

Examples

The following is sample output for the show crypto ipsec sa command:
Router# show crypto ipsec sa vrf vpn2
interface: Ethernet1/2
    Crypto map tag: ra, local addr. 172.16.1.1
   protected vrf: vpn2
   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   remote ident (addr/mask/prot/port): (10.4.1.4/255.255.255.255/0/0)
   current_peer: 10.1.1.1:500
     PERMIT, flags={}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0
     local crypto endpt.: 172.16.1.1, remote crypto endpt.: 10.1.1.1
     path mtu 1500, media mtu 1500
     current outbound spi: 50110CF8
     inbound esp sas:
      spi: 0xA3E24AFD(2749516541)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 5127, flow_id: 7, crypto map: ra
        sa timing: remaining key lifetime (k/sec): (4603517/3503)
        IV size: 8 bytes
        replay detection support: Y
     inbound ah sas:
     inbound pcp sas:
     outbound esp sas:
      spi: 0x50110CF8(1343294712)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 5128, flow_id: 8, crypto map: ra
        sa timing: remaining key lifetime (k/sec): (4603517/3502)
        IV size: 8 bytes
        replay detection support: Y
     outbound ah sas:
     outbound pcp sas:
The following configuration was in effect when the above show crypto ipsec sa vrf command was issued. The IPSec remote access tunnel was "UP" when this command was issued.
crypto dynamic-map vpn1 1
 set transform-set vpn1 
 set isakmp-profile vpn1-ra
 reverse-route
!
crypto dynamic-map vpn2 1
 set transform-set vpn2 
 set isakmp-profile vpn2-ra
 reverse-route
!
!
crypto map ra 1 ipsec-isakmp dynamic vpn1 
crypto map ra 2 ipsec-isakmp dynamic vpn2

IPSec and IKE Stateful Failover Examples

The following sample output shows the IPSec SA status of only the active device:
Router# show crypto ipsec sa active
interface: Ethernet0/0
    Crypto map tag: to-peer-outside, local addr 209.165.201.3
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (192.168.0.1/255.255.255.255/0/0)
   remote ident (addr/mask/prot/port): (172.16.0.1/255.255.255.255/0/0)
   current_peer 209.165.200.225 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 3, #pkts encrypt: 3, #pkts digest: 3
    #pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0
     local crypto endpt.: 209.165.201.3, remote crypto endpt.: 209.165.200.225
     path mtu 1500, media mtu 1500
     current outbound spi: 0xD42904F0(3559458032)
     inbound esp sas:
      spi: 0xD3E9ABD0(3555306448)
        transform: esp-3des ,
        in use settings ={Tunnel, }
        conn id: 2006, flow_id: 6, crypto map: to-peer-outside
        sa timing: remaining key lifetime (k/sec): (4586265/3542)
             HA last key lifetime sent(k): (4586267)
        ike_cookies: 9263635C CA4B4E99 C14E908E 8EE2D79C
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE
The following sample output shows the IPSec SA status of only the standby device:
Router# show crypto ipsec sa standby
interface: Ethernet0/0
    Crypto map tag: to-peer-outside, local addr 209.165.201.3
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (192.168.0.1/255.255.255.255/0/0)
   remote ident (addr/mask/prot/port): (172.16.0.1/255.255.255.255/0/0)
   current_peer 209.165.200.225 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0
     local crypto endpt.: 209.165.201.3, remote crypto endpt.: 209.165.200.225
     path mtu 1500, media mtu 1500
     current outbound spi: 0xD42904F0(3559458032)
     inbound esp sas:
      spi: 0xD3E9ABD0(3555306448)
        transform: esp-3des ,
        in use settings ={Tunnel, }
        conn id: 2012, flow_id: 12, crypto map: to-peer-outside
        sa timing: remaining key lifetime (k/sec): (4441561/3486)
             HA last key lifetime sent(k): (4441561)
        ike_cookies: 00000000 00000000 00000000 00000000
        IV size: 8 bytes
        replay detection support: Y
        Status: STANDBY
     inbound ah sas:
      spi: 0xF3EE3620(4092474912)
        transform: ah-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 2012, flow_id: 12, crypto map: to-peer-outside
        sa timing: remaining key lifetime (k/sec): (4441561/3486)
             HA last key lifetime sent(k): (4441561)
        ike_cookies: 00000000 00000000 00000000 00000000
        replay detection support: Y
        Status: STANDBY
     inbound pcp sas:
     outbound esp sas:
      spi: 0xD42904F0(3559458032)
        transform: esp-3des ,
        in use settings ={Tunnel, }
        conn id: 2011, flow_id: 11, crypto map: to-peer-outside
        sa timing: remaining key lifetime (k/sec): (4441561/3485)
             HA last key lifetime sent(k): (4441561)
        ike_cookies: 00000000 00000000 00000000 00000000
        IV size: 8 bytes
        replay detection support: Y
        Status: STANDBY
     outbound ah sas:
      spi: 0x75251086(1965363334)
        transform: ah-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 2011, flow_id: 11, crypto map: to-peer-outside
        sa timing: remaining key lifetime (k/sec): (4441561/3485)
             HA last key lifetime sent(k): (4441561)
        ike_cookies: 00000000 00000000 00000000 00000000
        replay detection support: Y
        Status: STANDBY
outbound pcp sas:

show crypto isakmp sa

To display current Internet Key Exchange (IKE) security associations (SAs), use the show crypto isakmp sa command in privileged EXEC mode.

show crypto isakmp sa [active | standby]
Syntax Description

active

(Optional) All existing IKE SAs that are in an active state are displayed.

standby

(Optional) All existing IKE SAs that are in standby state are displayed.

Command Modes

Privileged EXEC

Command History

Release

Modification

11.3 T

This command was introduced.

12.3(11)T

The active and standby keywords were added.

Usage Guidelines

If neither the active keyword nor the standby keyword are specified, current SAs for all configured routers will be shown.

Examples

The following sample output shows the SAs of both the active and standby devices:
Router# show crypto isakmp sa
dst             src             state          conn-id slot status
209.165.201.3   209.165.200.225 QM_IDLE              2    0 STDBY 
10.0.0.1        10.0.0.2        QM_IDLE              1    0 ACTIVE
The following sample output shows the SAs of only the active device:
Router# show crypto isakmp sa active
dst             src             state          conn-id slot status
209.165.201.3   209.165.200.225 QM_IDLE              5    0 ACTIVE
The following sample output shows the SAs of only the standby device:
Router# show crypto isakmp sa standby
dst             src             state          conn-id slot status
209.165.201.3   209.165.200.225 QM_IDLE              5    0 STDBY 
209.165.201.3   209.165.200.225 QM_IDLE              1    0 STDBY 
Table 2 through Table 5 show the various states that may be displayed in the output of the show crypto isakmp sa command. When an Internet Security Association and Key Management Protocol (ISAKMP) SA exists, it will most likely be in its quiescent state (QM_IDLE). For long exchanges, some of the MM_xxx states may be observed.

Table 2 States in Main Mode Exchange

State

Explanation

MM_NO_STATE

The ISAKMP SA has been created, but nothing else has happened yet. It is "larval" at this stage—there is no state.

MM_SA_SETUP

The peers have agreed on parameters for the ISAKMP SA.

MM_KEY_EXCH

The peers have exchanged Diffie-Hellman public keys and have generated a shared secret. The ISAKMP SA remains unauthenticated.

MM_KEY_AUTH

The ISAKMP SA has been authenticated. If the router initiated this exchange, this state transitions immediately to QM_IDLE, and a Quick Mode exchange begins.

Table 3 States in Aggressive Mode Exchange

State

Explanation

AG_NO_STATE

The ISAKMP SA has been created, but nothing else has happened yet. It is "larval" at this stage—there is no state.

AG_INIT_EXCH

The peers have done the first exchange in aggressive mode, but the SA is not authenticated.

AG_AUTH

The ISAKMP SA has been authenticated. If the router initiated this exchange, this state transitions immediately to QM_IDLE, and a quick mode exchange begins.

Table 4 States in Quick Mode Exchange

State

Explanation

QM_IDLE

The ISAKMP SA is idle. It remains authenticated with its peer and may be used for subsequent quick mode exchanges. It is in a quiescent state.

Table 5 show crypto isakmp sa Field Descriptions

Field

Description

f_vrf/i_vrf

The front door virtual routing and forwarding (FVRF) and the inside VRF (IVRF) of the IKE SA. If the FVRF is global, the output shows f_vrf as an empty field.

Related Commands

Command

Description

crypto isakmp policy

Defines an IKE policy.

lifetime (IKE policy)

Specifies the lifetime of an IKE SA.

show crypto session

To display status information for active crypto sessions, use the show crypto session command in privileged EXEC mode.

show crypto session [detail] | [local ip-address [port local-port] [remote ip-address [port remote-port]] [detail]] | [fvfr vrf-name] [ivrf vrf-name] [detail]
IPSec and IKE Stateful Failover Syntax

show crypto session [active | standby]
Syntax Description

detail

(Optional) Provides more detailed information about the session, such as the capability of the Internet Key Exchange (IKE) security association (SA), connection ID, remaining lifetime of the IKE SA, inbound or outbound encrypted or decrypted packet number of the IP Security (IPSec) flow, dropped packet number, and kilobyte-per-second lifetime of the IPSec SA.

local ip-address

(Optional) Displays status information about crypto sessions of a local crypto endpoint.

•The ip-address value is the IP address of the local crypto endpoint.

port local-port

(Optional) Port of the local crypto endpoint.

•The local-port value can be 1 through 65535. The default value is 500.

remote ip-address

(Optional) Displays status information about crypto sessions of a remote session.

•The ip-address value is the IP address of the remote crypto endpoint.

port remote-port

(Optional) Displays status information about crypto sessions of a remote crypto endpoint.

•The remote-port value can be 1 through 65535. The default value is 500.

fvfr vrf-name

(Optional) Displays status information about the front door virtual routing and forwarding (FVRF) session.

ivrf vrf-name

(Optional) Displays status information about the inside VRF (IVRF) session.

active

(Optional) Displays all crypto sessions in the active state.

standby

(Optional) Displays all crypto sessions that are in the standby state.

Defaults

If the show crypto session command is entered without any keywords, all existing sessions will be displayed. Port default values are 500.

Command Modes

Privileged EXEC

Command History

Release

Modification

12.3(4)T

This command was introduced.

12.3(11)T

The active and standby keywords were added.

Usage Guidelines

You can get a list of all the active Virtual Private Network (VPN) sessionsand of the IKE and IPSec SAs for each VPN session by entering the show crypto session command. The listing will include the following:

•Interface

•IKE peer description, if available

•IKE SAs that are associated with the peer by whom the IPSec SAs are created

•IPSec SAs serving the flows of a session

Multiple IKE or IPSec SAs may be established for the same peer (for the same session), in which case IKE peer descriptions will be repeated with different values for the IKE SAs that are associated with the peer and for the IPSec SAs that are serving the flows of the session.

Examples

The following example shows active VPN sessions:
Router# show crypto session detail
Crypto session current status
Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, X - IKE Extended Authentication
Interface: Ethernet1/0
Session status: UP-NO-IKE
Peer: 10.2.80.179/500 fvrf: (none) ivrf: (none)
      Desc: My-manual-keyed-peer
      Phase1_id: 10.2.80.179
  IPSEC FLOW: permit ip host 10.2.80.190 host 10.2.80.179
        Active SAs: 4, origin: manual-keyed crypto map
        Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
        Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
Interface: Ethernet1/2
Session status: DOWN
Peer: 10.1.1.1/500 fvrf: (none) ivrf: (none)
      Desc: SJC24-2-VPN-Gateway
      Phase1_id: 10.1.1.1
  IPSEC FLOW: permit ip host 10.2.2.3 host 10.2.2.2
        Active SAs: 0, origin: crypto map
        Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
        Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
  IPSEC FLOW: permit ip 10.2.0.0/255.255.0.0 10.4.0.0/255.255.0.0
        Active SAs: 0, origin: crypto map
        Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
        Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
Interface: Serial2/0.17
Session status: UP-ACTIVE
Peer: 10.1.1.5/500 fvrf: (none) ivrf: (none)
      Desc: (none)
      Phase1_id: 10.1.1.5
  IKE SA: local 10.1.1.5/500 remote 10.1.1.5/500 Active
          Capabilities:(none) connid:1 lifetime:00:59:51
  IPSEC FLOW: permit ip host 10.1.1.5 host 10.1.2.5
        Active SAs: 2, origin: dynamic crypto map
        Inbound:  #pkts dec'ed 4 drop 0 life (KB/Sec) 20085/171
        Outbound: #pkts enc'ed 4 drop 0 life (KB/Sec) 20086/171
Table 6 describes the significant fields shown in the display.

Table 6 show crypto isakmp peer Field Descriptions

Field

Description

Interface

Interface to which the crypto session is related.

Session status

Current status of the crypto (VPN) sessions. See Table 7 for the status of the IKE SA, IPSec SA, and tunnel as shown in the display.

IKE SA

Information is provided about the IKE SA, such as local and remote address and port, SA status, SA capabilities, crypto engine connection ID, and remaining lifetime of the IKE SA.

IPSEC FLOW

A snapshot of information about the IPSec-protected traffic flow, such as what the flow is (for example, permit ip host 10.1.1.5 host 10.1.2.5); how many IPSec SAs there are; the origin of the SA, such as manual keyed, dynamic, or static crypto map; the number of encrypted or decrypted packets or dropped packets; and the IPSec SA remaining lifetime in kilobytes per second.

Table 7 provides an explanation of the current status of the VPN sessions shown in the display.

Table 7 Current Status of the VPN Sessions

IKE SA

IPSec SA

Tunnel Status

Exist, active

Exist (flow exists)

UP-ACTIVE

Exist, active

None (flow exists)

UP-IDLE

Exist, active

None (no flow)

UP-IDLE

Exist, inactive

Exist (flow exists)

UP-NO-IKE

Exist, inactive

None (flow exists)

DOWN-NEGOTIATING

Exist, inactive

None (no flow)

DOWN-NEGOTIATING

None

Exist (flow exists)

UP-NO-IKE

None

None (flow exists)

DOWN

None

None (no flow)

DOWN

Note IPSec flow may not exist if a dynamic crypto map is being used.

The following sample output shows all crypto sessions that are in the standby state:
Router# show crypto session standby
Crypto session current status
Interface: Ethernet0/0
Session status: UP-STANDBY    
Peer: 209.165.200.225 port 500 
  IKE SA: local 209.165.201.3/500 remote 209.165.200.225/500 Active 
  IKE SA: local 209.165.201.3/500 remote 209.165.200.225/500 Active 
  IPSEC FLOW: permit ip host 192.168.0.1 host 172.16.0.1 
        Active SAs: 4, origin: crypto map
Related Commands

Command

Description

clear crypto session

Deletes crypto sessions (IPSec and IKE SAs).

description

Adds a description for an IKE peer.

show crypto isakmp peer

Displays peer descriptions.

show redundancy

To display current or historical status and related information on planned or logged handovers, use the show redundancy command in privileged EXEC mode.

show redundancy [clients | counters | debug-log | handover | history | states | inter-device]
Syntax Description

clients

(Optional) Redundancy-aware client-application list.

counters

(Optional) Redundancy-related operational measurements.

debug-log

(Optional) Log of up to 256 redundancy-related debug entries.

handover

(Optional) Details of any pending scheduled handover.

history

(Optional) Log of past status and related information about logged handovers. This is the only keyword supported on the Cisco AS5800.

states

(Optional) Redundancy-related states: disabled, initialization, standby, active (various substates for the latter two).

inter-device

(Optional) Redundancy inter-device operational state and statistics.

Command Modes

Privileged EXEC

Command History

Release

Modification

11.3(6)AA

This command was introduced.

12.2(8)T

This command was integrated into Cisco IOS Release 12.2(8)T. Support for the Cisco AS5800 and Cisco AS5850 is not included in this release.

12.2(11)T

This command is supported on the Cisco AS5800 and Cisco AS5850 in this release.

12.3(8)T

The inter-device keyword was added.

Usage Guidelines

Cisco AS5800: Use this command from the router-shelf console to determine when failover is enabled. Use this command with the history keyword to log failover events.

Cisco AS5850: To use this command, you must have two route-switch-controller (RSC) cards installed and you must be connected to one of them.

Examples

The following is sample output from the show redundancy handover and show redundancy states commands on a Cisco AS5850:
Router# show redundancy handover
No busyout period specified
Handover pending at 23:00:00 PDT Wed May 9 2001
Router# show redundancy states
my state = 14 -ACTIVE_EXTRALOAD
peer state = 4 -STANDBY COLD
Mode = Duplex
Unit = Preferred Primary
Unit ID = 6
Redundancy Mode = Handover-split: If one RSC fails, the peer RSC will take over the 
feature boards
Maintenance Mode = Disabled
Manual Swact = Disabled Reason: Progression in progress
Communications = Up
client count = 3
client_notification_TMR = 30000 milliseconds
keep_alive TMR = 4000 milliseconds
keep_alive count = 1
keep_alive threshold = 7
RF debug mask = 0x0
The following is sample output from the show redundancy command on a Cisco AS5800:
Router# show redundancy
DSC in slot 12:
Hub is in 'active' state.
Clock is in 'active' state.
DSC in slot 13:
Hub is in 'backup' state.
Clock is in 'backup' state.
The following is sample output from the show redundancy history command on a Cisco AS5800:
Router# show redundancy history
DSC Redundancy Status Change History:
981130 18:56 Slot 12 DSC: Hub, becoming active - RS instruction
981130 19:03 Slot 12 DSC: Hub, becoming active - D13 order
The following is sample output from two Cisco AS5800 router shelves configured as a failover pair. The active router shelf is initially RouterA. The show redundancy history and show redundancy commands have been issued. The show redundancy command shows that failover is enabled, shows the configured group number, and shows that this router shelf is the active one of the pair. Compare this output with that from the backup router shelf (RouterB) further below.

Note When RouterA is reloaded, thereby forcing a failover, new entries are shown on RouterB when a
show redundancy history command is issued after failover has occurred.

Log from the First Router (RouterA)
RouterA# show redundancy history
DSC Redundancy Status Change History:
010215 18:17 Slot -1 DSC:Failover configured -> ACTIVE role by default.
010215 18:18 Slot -1 DSC:Failover -> BACKUP role.
010215 18:18 Slot 12 DSC:Failover -> ACTIVE role.
010215 18:18 Slot 12 DSC:Hub, becoming active - arb timeout
RouterA# show redundancy
failover mode enabled, failover group = 32
Currently ACTIVE role.
DSC in slot 12:
Hub is in 'active' state.
Clock is in 'active' state.
No connection to slot 13
RouterA# reload
Proceed with reload? [confirm] y
*Feb 15 20:19:11.059:%SYS-5-RELOAD:Reload requested
System Bootstrap, Version xxx
Copyright xxx by cisco Systems, Inc.
C7200 processor with 131072 Kbytes of main memory
Log from the Second Router (RouterB)
RouterB# show redundancy
failover mode enabled, failover group = 32
Currently BACKUP role.
No connection to slot 12
DSC in slot 13:
Hub is in 'backup' state.
Clock is in 'backup' state.
*Feb 16 03:24:53.931:%DSC_REDUNDANCY-3-BICLINK:Switching to DSC 13
*Feb 16 03:24:53.931:%DSC_REDUNDANCY-3-BICLINK:Failover:changing to active mode
*Feb 16 03:24:54.931:%DIAL13-3-MSG:
02:32:06:%DSC_REDUNDANCY-3-EVENT:Redundancy event:LINK_FAIL from other DSC
*Feb 16 03:24:55.491:%OIR-6-INSCARD:Card inserted in slot 12, interfaces administratively 
shut down
*Feb 16 03:24:58.455:%DIAL13-3-MSG:
02:32:09:%DSC_REDUNDANCY-3-EVENT:Redundancy event:LINK_FAIL from other DSC
*Feb 16 03:25:04.939:%DIAL13-0-MSG:
RouterB# show redundancy
failover mode enabled, failover group = 32
Currently ACTIVE role.
No connection to slot 12
DSC in slot 13:
Hub is in 'active' state.
Clock is in 'backup' state.
RouterB# show redundancy history
DSC Redundancy Status Change History:
010216 03:09 Slot -1 DSC:Failover configured -> BACKUP role.
010216 03:24 Slot 13 DSC:Failover -> ACTIVE role.
010216 03:24 Slot 13 DSC:Hub, becoming active - D12 linkfail
010216 03:24 Slot 13 DSC:Hub, becoming active - D12 linkfail
*Feb 16 03:26:14.079:%DSIPPF-5-DS_HELLO:DSIP Hello from shelf 47 slot 1 Succeeded
*Feb 16 03:26:14.255:%DSIPPF-5-DS_HELLO:DSIP Hello from shelf 47 slot 3 Succeeded
*Feb 16 03:26:14.979:%DSIPPF-5-DS_HELLO:DSIP Hello from shelf 47 slot 10 Succeeded
Related Commands

Command

Description

debug redundancy

Displays information used for troubleshooting dual (redundant) router shelves (Cisco AS5800) or RSCs (Cisco AS5850).

hw-module

Enables the router shelf to stop a DSC or to restart a stopped DSC.

redundancy

Enters redundancy configuration mode.

show chassis

Displays, for a router with two RSCs, information about mode (handover-split or classic-split), RSC configuration, and slot ownership.

Copyright © 2004 Cisco Systems, Inc. All rights reserved.

Hierarchical Navigation

Cisco IOS Software Releases 12.3 T

Stateful Failover for IPSec

Downloads

Table Of Contents

Stateful Failover for IPSec

Contents

Prerequisites for Stateful Failover for IPSec

Restrictions for Stateful Failover for IPSec

Information About Stateful Failover for IPSec

Supported Deployment Scenarios: Stateful Failover for IPSec

IPSec Stateful Failover for Remote Access Connections

How to Use Stateful Failover for IPSec

Enabling HSRP: IP Redundancy and a Virtual IP Address

Prerequisites for Spanning Tree Protocol and HSRP Stability

Restrictions

SUMMARY STEPS

DETAILED STEPS

Troubleshooting Tips

Examples

What to Do Next

Enabling SSO

SSO: Interacting with IPSec and IKE

Prerequisites

SUMMARY STEPS

DETAILED STEPS

Troubleshooting Tips

Examples

What to Do Next

Configuring Reverse Route Injection on a Crypto Map

Configuring RRI on Dynamic Crypto Map

SUMMARY STEPS

DETAILED STEPS

Configuring RRI on a Static Crypto Map

SUMMARY STEPS

DETAILED STEPS

Examples

What to Do Next

Enabling Stateful Failover for IKE and IPSec

Enabling Stateful Failover for IKE

Enabling Stateful Failover for IPSec

SUMMARY STEPS

DETAILED STEPS

Troubleshooting Tips

Examples

Enabling Stateful Failover for Tunnel Protection

Restrictions

SUMMARY STEPS

DETAILED STEPS

Examples

What to Do Next

Protecting SSO Traffic

SUMMARY STEPS

DETAILED STEPS

Examples

Managing and Verifying High Availability Information

Managing Anti-Replay Intervals

SUMMARY STEPS

DETAILED STEPS

Examples

Managing and Verifying HA Configurations

SUMMARY STEPS

DETAILED STEPS

Examples

Configuration Examples for Stateful Failover

Configuring IPSec Stateful Failover: Example

Configuring IPSec Stateful Failover for an Easy VPN Server: Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

clear crypto isakmp

Syntax Description

Command Modes

Command History

Usage Guidelines

Examples