Configure IPsec failover

You can configure the Connect EZ device to fail over from a primary IPsec tunnel to a backup tunnel:

• Preferred tunnel—When multiple IPsec tunnels are configured, one tunnel can be configured as a backup to another tunnel by defining a preferred tunnel for the backup device.

Required configuration items

• Two or more configured IPsec tunnels: The primary tunnel, and one or more backup tunnels.

IPsec failover using Preferred tunnel

  Web

1. Configure the primary IPsec tunnel. See Configure an IPsec tunnel for instructions.
2. Create a backup IPsec tunnel. See Configure an IPsec tunnel for instructions.
3. During configuration of the backup IPsec tunnel, identify the primary IPsec tunnel in the Preferred tunnel parameter:

   

  Command line

1. Configure the primary IPsec tunnel. See Configure an IPsec tunnel for instructions.
2. Create a backup IPsec tunnel. See Configure an IPsec tunnel for instructions.
3. During configuration of the backup IPsec tunnel, identify the primary IPsec tunnel:
   1. Use the ? to view a list of available tunnels:

      (config vpn ipsec tunnel backup_ipsec_tunnel)> ipsec_failover ?
      
      Preferred tunnel: This tunnel will not start until the preferred tunnel has failed. It will continue
      to operate until the preferred tunnel returns to full operation status.
      Format:
       primary_ipsec_tunnel
       backup_ipsec_tunnel
      Optional: yes
      Current value:
      
      (config vpn ipsec tunnel backup_ipsec_tunnel)> ipsec_failover

   2. Set the primary IPsec tunnel:

      (config vpn ipsec tunnel backup_ipsec_tunnel)> ipsec_failover primary_ipsec_tunnel
      (config vpn ipsec tunnel backup_ipsec_tunnel)>