0

Few weeks ago i had asked help regarding the High Availablity in Cisco 4331 and recently i managed to sort it out with the help i got here. Here is the link to it:

High availability confiugration in Cisco 4331 routers

It does the failover and failback well with NAT box to box High Availability. But as per the new requirement, i want high availability without having to write the same configurations on both the routers. If i write some changes in primary router, i want to be synced to the secondary router. I have seen this feature in many firewalls link Sonicwall, Fortigate and so on. I am not sure if it happens in cisco 4331 routers. I have confiugred the box-to-box high availability with redundancy mode as none and as per some cisco documents we could use mode SSO as well.Here is the link:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-0SY/configuration/guide/15_0_sy_swcg/stateful_switchover.pdf

Is mode SSO my solution? The reason i need to sync 2 cisco routers is that i need to configure dual VPN between cisco 4331 and Cisco 4221. If i do box-to-box HA ,then i need to configure 4 vpn configurations in branch device and switchover becomes difficult when primary goes down. could any one suggest me regarding the syncing of cofigurations in two cisco 4331 rotuers?

My routers only show redundancy mode as none. There is no way i can change it to redundancy mode SSO.

RTR02-Sec#sh redundancy

Redundant System Information :

   Available system uptime = 53 minutes

Switchovers system experienced = 0 Standby failures = 0 Last switchover reason = none

             **Hardware Mode = Simplex
Configured Redundancy Mode = Non-redundant
 Operating Redundancy Mode = Non-redundant
          Maintenance Mode = Disabled
            Communications = Down      Reason: Failure**

Current Processor Information :

           Active Location = slot 6
    Current Software state = ACTIVE
   Uptime in current state = 53 minutes
             Image Version = Cisco IOS Software [Everest], ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 16.6.4, RELEASE S                                                  OFTWARE (fc3)

Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2018 by Cisco Systems, Inc. Compiled Sun 08-Jul-18 04:33 by mcpre BOOT = bootflash:isr4300-universalk9.16.06.04.SPA.bin,1; Configuration register = 0x2102

Peer (slot: 7) information is not available because it is in 'DISABLED' state

After some study, i have come to this conclusion that i need the router to be in mode SSO and hardware mode should be Duplex instead of simplex.

Is there any way i can convert the redundancy mode to duplex and make the secondary router sync the information of Primary router?

Thank you for the help in advance.

4
  • SSO is for establishing redundancy between route processors (RPs) in a single Cisco chassis (and perhaps between VSS members). You will not be able to establish SSO between a pair of routers. To my knowledge, there is no way to sync configs between two Cisco routers, nor would you want to. Sep 25 '19 at 0:25
  • Are your switches capable of layer 3? Maybe you should not have the routers inside your firewall perimeter, and just use the switches to route, instead. Sep 25 '19 at 0:26
  • 1
    Why don't you configure the VPN tunnels to your firewalls rather than to the routers? Perhaps those firewalls are an HA pair that would provide the redundancy that your looking for. Sep 25 '19 at 0:27
  • @user3629081 yes now my option is to have VPN tunnels to the firewalls. I was expecting if there was any way for syncing the configs between primary and secondary device.
    – de.walkar
    Sep 25 '19 at 2:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.