31.7.1 Speci?¬?es the IP address of
the IPsec peer
62 Con?¬?guring High Availability VPNs
Step 3: Add Programming for Crypto Redundancy Con?¬?guration
HSRP2(config-crypto-map)#set transform-set
TRANS-1
Speci?¬?es the use of the
transform set TRANS-1
for IKE phase 2 policy
HSRP2(config-crypto-map)#match address PEEROUTSIDE
De?¬?nes the IP addresses
for the IPsec tunnel
HSRP2(config-crypto-map)#exit Exits to global
con?¬?guration mode
HSRP1(config)#crypto ipsec transform-set
TRANS-2 ah-md5-hmac esp-aes
Creates the transform set
TRANS-2 for the IKE
phase 2 policy
HSRP1(cfg-crypto-trans)#exit Exits to global
con?¬?guration mode
HSRP1(config)#crypto ipsec profile SSO1-SECURE Creates the general pro?¬?le
SSO1-SECURE for IPsec
policy
HSRP1(ipsec-profile)#set transform-set TRANS-2 Speci?¬?es a transform set
HSRP1(ipsec-profile)#exit Exits to global
con?¬?guration mode
HSRP1(config)#redundancy inter-device Enters interdevice
con?¬?guration mode
HSRP1(config-red-interdevice)#scheme standby
HSRP-IN
Names the redundancy
scheme used between two
devices
HSRP1(config-red-interdevice)#security ipsec
SSO1-SECURE
Speci?¬?es the IPsec pro?¬?le
HSRP1(config-red-interdevice)#exit Exits to global
con?¬?guration mode
HSRP2(config)#crypto ipsec profile SSO2-SECURE Creates the general pro?¬?le
SSO1-SECURE for IPsec
policy
HSRP2(ipsec-profile)#set transform-set TRANS-2 Speci?¬?es a transform set
Con?¬?guring High Availability VPNs 63
Step 4: De?¬?ne the Interdevice Communication Protocol (HSRP1
and HSRP)
HSRP2(ipsec-profile)#exit Exits to global
con?¬?guration mode
HSRP2(config)#redundancy inter-device Enters interdevice
con?¬?guration mode
HSRP2(config-red-interdevice)#scheme standby
HSRP-IN
Names the redundancy
scheme used between two
devices
HSRP2(config-red-interdevice)#security ipsec
SSO2-SECURE
Speci?¬?es the IPsec pro?¬?le
HSRP2(config-red-interdevice)#exit Exits to global
con?¬?guration mode
HSRP1(config)#ipc zone default Con?¬?gures the interdevice
communication protocol
HSRP1(config-ipczone)#association 1 Creates an association
between the two devices
HSRP1(config-ipczone-assoc)#no shutdown Enables the association
HSRP1(config-ipczone-assoc)#protocol sctp Con?¬?gures Stream
Control Transmission
Protocol (SCTP)
HSRP1(config-ipc-protocol-sctp)#local-port
5000
De?¬?nes the local SCTP
port number used to
communicate with the
redundant peer
HSRP1(config-ipc-local-sctp)#local-ip
10.
Pages:
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69