IPSec Virtual Private Network Fundamentals

This chapter outlines a broad scope of concepts required for understanding IPSec VPN HA. In summary, there are five very broad components of IPSec VPN HA that should be explored when designing HA into an IPSec VPN deployment:

  • Network redundancy

  • Termination redundancy

  • Path availability mechanisms

  • Path symmetry mechanisms

  • Load balancing alternatives

This chapter ties in with various topologies discussed in previous HA discussions, and the book continues to do so in subsequent HA chapters. There are many different design options for each of the HA categories listed previously in this summary and introduced previously in this chapter. Table 5-2 shows some design concepts that you should be familiar with at this point in the text and the area of HA to which they pertain.

Table 5-2. HA Design Summary

HA Deployment Option

HA Deployment Category

Advantages and disadvantages of terminating IPSec on multiple interfaces versus terminating IPSec on a Virtual Interface (HSRP/VRRP).

Termination redundancy

IKE Keepalives and Dead Peer DetectionThe similarities and differences of each and when to use one or the other.

Path availability

When to use multiple peering statements for tunnel redundancy and when to rely on the underlying RP for tunnel redundancy.

Termination redundancy network redundancy

What load balancing is and where it fits into the IPSec HA paradigm.

Load balancing and HA

Encrypted RPs and GRE KeepalivesWhy they are useful and the associated packet and performance overhead.

Path availability

BGP and IGPs with Unicast NeighborsWhen they are a useful design alternative to encrypted RPs.

Path availability

How RRI, RP Metrics, and HSRP can all be used to abate IPSec control plane issues with path asymmetry.

Path symmetry

DNS-based IPSec load balancing, RP-based IPSec load balancing, IPSec load balancing alternate with peering statements, VPN3000 clustering with VCA, and IPSec load balancing with external load balancers: What each method requires, the advantages/disadvantages of each, and when to consider each design option.

Load balancing and HA

The ensuing chapters discuss these design concepts in greater detail, including configuration and troubleshooting steps. Each subject is presented in the context of local High Availability (Chapter 6, "Site-to-Site Local HA Solutions") and geographic High Availability (Chapter 7, "Site-to-Site Geographic HA Solutions"). Many of the IPSec HA design options introduced in this chapter, such as VPN3000 clustering, pertain to RAVPN environments. The HA discussions in Chapter 9, "Remote Access VPN High Availability," focus solely on RAVPN environments.

Related

Категории