myITmicroblog

Update to GET VPN - part four (multicast) - http://myitmicroblog.blogspot.com/2014/12/get-vpn-part-four-multicast.html On one of my GMs I found a problem. It was registered but I didn’t see any ‘rekeys received’:   R3 #sh crypto gdoi gm rekey Group GDOI - GROUP - GREEN No rekey info available Group GDOI - GROUP - RED ( Multicast ) Number of Rekeys received ( cumulative ) : 0 Number of Rekeys received after registration : 0 Multicast destination address : 239.192 . 1.190 R3 # I saw following messages:   R3 # * Dec 20 06 : 06 : 04.404 : % GDOI - 4 - GM_RE_REGISTER : The IPSec SA created for group GDOI - GROUP - RED may have expired / been cleared , or didn 't go through. Re-register to KS. R3# *Dec 20 06:06:04.412: %CRYPTO-5-GM_REGSTER: Start registration to KS 3.3.3.2 for group GDOI-GROUP-RED using address 7.7.7.2 *Dec 20 06:06:05.000: %GDOI-5-SA_KEK_UPDATED: SA KEK was updated *Dec 20 06:06:05.008: %GD...

Today I would like to talk about high availability. The second KS is one example how we can increase its availability. Let’s think about GMs. If there are more paths than one to a KS we should consider using a loopback interface for communication with the KS.      We can add following command on the GM: crypto map MAP - NAME local - address INT - NAME We have to ensure that: the loopback interface is reachable from KS’ FW access list accepts traffic from and to this IP ISAKMP SA from a KS before change: R2 #sh crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn - id status 6.6 . 6.2 4.4 . 4.2 GDOI_IDLE 1002 ACTIVE 3.3 . 3.2 6.6 . 6.2 GDOI_IDLE 1030 ACTIVE 7.7 . 7.2 6.6 . 6.2 GDOI_REKEY 0 ACTIVE 7.7 . 7.2 6.6 . 6.2 GDOI_REKEY 0 ACTIVE 6.6 . 6.2 5.5 . 5.2 GDOI_IDLE 1073 ACTIVE...