14

I have been migrating sites away from policy-based VPNs for just this reason. Policy-based VPNs are too unpredictable when it comes to failover behavior. I much prefer route-based IPsec tunnels, either point-to-point or DMVPN. Unfortunately, to my knowledge the ASA platform still doesn't support route-based tunnels.


10

I am looking for a technology to achieve TCP connection fault tolerance with the help of two links between hosts and without time delays for route failure detection. Something like this: link1 packet1copy1-> -------------------------- packet1-> / \ packet1copy1/...


9

I would recommend using a DMVPN solution to connect remote sites over L2L (Lan-to-Lan) IPSec tunnels between ASAs. The DMVPN solution is much easier, cleaner, and will allow spoke to spoke communication as well.


8

I don't believe there is a way to directly poll the results of the OR via SNMP, but you can certainly poll for the IP SLA results and calculate it yourself. Using the CISCO-RTTMON-MIB (1.3.6.1.4.1.9.9.42), you can check the timeout value of your reachability checks, take the true/false value it returns and do the OR in whatever scripting language you're ...


7

Assuming a single context active/passive failover configuration with the ASAs connecting to the 2911s on unique subnets, you could trunk the links using two subinterfaces and vlan tagging. But the hack is to not have both subinterfaces active at the same time on a single ASA. On the ASA on the left assuming it's active, the first subint would be alive and ...


7

This is a fixed, unchanging network that serves only this dedicated application. I think you’re finding that this is rarely the norm with networking, even with unchanging networks; hence, why you’re here asking how to automate this. Eventually, another link comes online that requires you to reengineer all of your previous efforts. This is, by definition, ...


7

If i remember, default spanning tree (802.1d) takes about 50 secs to reconverge. That is the duration for which you will be losing frames. A link is detected down by the loss of 10 hello pkts. These are usually 2 secs apart. So total=20 secs. This is called the max-age timer Next it has to transition another blocked port through listening and learning ...


6

As long as both interfaces have public IP addresses, which it sounds like, you have two options: 1) IP SLA: outbound traffic will only use one interface at a time. Essentially, you configure a static default route out the primary interface, which is tracked and a static default route out the secondary interface. If the tracking finds an issue, the tracked ...


6

It is possible, even likely, that at least one (probably more) frames will be lost on any failover. The speed of the failover is highly dependent on what type of redundancy you are using. Spanning Tree is the slowest, routing is an order of magnitude faster, and etherchannels are yet and order of magnitude faster than that. When frames are lost, there is ...


6

You forgot to use the standby 5 preempt command. It is also a good idea to set a preempt delay. Hot Standby Router Protocol (HSRP): Frequently Asked Questions: Q. Which HSRP router requires that I configure preempt? A. An HSRP-enabled router with preempt configured attempts to assume control as the active router when its Hot Standby priority is ...


5

We had the same issue and I found solution for it: It is called Expression MIB as per RFC 2982. You can do logical OR on this level by creating of new SNMP OID object which will be calculated at the same time as the SNMP Request comes to router/switch for this OID. Afterwards you can use this object to poll SNMP statistics of 2 or more ORed (via Expression ...


5

One solution is to use Performance routing (PfR) on the gateway routers. PfR can test connectivity to each data center and then route traffic to whichever one is responding. So if a tunnel goes down, PfR will automatically route traffic through the other tunnel to the other data center. PfR can do this by pinging (or using IP SLA) each of the data ...


5

The ASA does not have a mechanism to mark peers as up or down. When DPD detects a peer is no longer available, any SA with that peer is torn down. When "interesting traffic" requires a new SA, the ASA goes through its normal phase 1 process, which means starting with the first peer in your crypto map and if a connection cannot be established, trying the ...


5

You're mixing up terminology a bit here. There's no such thing as an IPv4 ASN or IPv6 ASN. There's IP space, which is either IPv4 or IPv6, and there are ASN's. An ASN can announce IPv4 prefixes, IPv6 prefixes, or both. As you concluded, PI space (at least in the RIPE region, which roughly covers EMEA, but I think the same goes for other RIRs) is depleted. ...


5

There is a command made for such checking. Use: show ip eigrp events


4

Could be: CSCub92666 ASA:Old connections tear down IPSEC vpn tunnel on switchover Symptom: In IPsec vpn tunnel fail over configuration on ASA,fail over from primary to backup link works. But after second fail over from backup to primary link vpn tunnel start flapping in few minutes and remains unstable. The behavior is observed because of old leftover ...


4

We have a similar setup but with two sets of 8.2(5) and we have used an in-house script to detect config changes to the primary pair, change the necessary details to make it connectable in the second DC and push the config to the second firewall pair and finally reboot. This only works for us because the second FW pair is completely passive whilst a ...


4

At what point do you push Cisco for hardware or RAM replacement? Whenever you feel like you can't afford the risk of the HW being bad. Single-bit parity errors happen because Cisco used non-ECC memory in some components of the Supervisor. As long as an occasional 3-second SSO failover is tolerable, just roll with Cisco's recommendation, because solar ...


4

OK, from the top; Down vote on your question from me; your question isn't clear enough based on your responses in comments to other peoples answer. You have assumed the solution is networking engineering related but you don't seem to know, and give the impression that you hope someone is going to give you the answer you need. You have the following problem ...


4

How do i check the status of failover to make failover is correctly configure. These commands will give a good indicator of the status and configuration show failover show failover state show monitor-interface show running-config failover Is there any downtime or small packet loss? This depends on the type of traffic (Stateful/Non-Stateful), type of ...


4

Yes, you can confirm that. Once hold-time expires, the former feasible successor route immediately becomes the successor route and is installed in routing table. I do not think we have a log message of when a feasible successor route becomes a successor route, given the fact that it happens right at the same time when the message of Neighbor 192.168.14.17 (...


3

I am no expert on these devices, but in looking at the D4E1/D8Eq modules that you reference, it looks like you could possibly take the incoming E1 circuit and break it into two fractional-E1 circuits. Then you could connect one half of the E1 to each router, but you would be permanently halving your throughput on that particular E1. Perhaps you could ...


3

I'm not sure what you're doing, if you're manually 'failing over'. It should happen automatically either when you experience change in linkstate or BFD/IGP/BGP liveness timers expire. To avoid routing protocol instability caused by rapid flapping you can use 'dampening' in IOS config or 'hold-time' in JunOS config, both will allow you to create artificial ...


3

Generally you'll want to be using BFD to ensure your forwarding plane is working. If not, you can run IP SLA, to at least two external IPs and fail over if you can't get to both


3

You want to implement NIC teaming on the server. Depending on the server and OS there are drivers assoicated with the NICs, or if you run windows 2012 that feature is built into the OS. There may be other OSes that support NIC teaming (I know esx does) but I am not familiar with ,NIX. Or you can try to 'dual home' the server that is give each NIC its own IP ...


3

What models are those Cisco switches? If you can stack them, then yes - You can connect them in stack and aggregate ports from both of them to the servers, and connections will work. If you can't stack them, but you can connect them together, you can still connect the servers to both of them, but you won't be able (propably) aggregate ports from both of ...


3

In a word: NO. Your IP address changes when you change ISPs. So any calls currently active on the now-down-ISP will fail. (there may be some trickery that could get the call(s) to redirect/forward to a new SIP endpoint, but I don't think that can work with the current endpoint unreachable.) If you have a tunnel to your internet voip provider, then yes, you ...


3

Using a 2nd Uplink and using link aggregation (etherchannel) is the right way to go. Keep in mind that your throughput problems might be due to the ASAs limitations (which model do you use?) Another thing to keep in mind is the load balancing algorithm you use for etherchannel (src-mac, src-dst-mac, src-dst-ip, src-dst-mac-ip). Based on your traffic ...


3

Switches only forward frames based MAC address. The secondary ASA takes over the MAC address of the failed ASA. Cisco has an explanation of the process.


3

Based on your question about the routing protocol, I will assume you are not running one, but you are using static routes, probably static default routes. You could use a routing protocol, but you would need to make the connected default route on Link 2 have a worse AD than the default route received from the routing protocol. A routing protocol will also ...


Only top voted, non community-wiki answers of a minimum length are eligible