IPsec VPN High Availability with HSRP

IPsec VPN High Availability with HSRP

This is a feature of that support VPN with HSRP, redundant IPsec peer for VPN network.
Some notes for this topic:
-HSRP only support on Ethernet and some L2 ATM, such as LANE...
-With the test on 12.4, there're difference in time to recover the VPN connection b/w two peers. Recover time from secondary router ( previously standby) is faster. Preempt delay time is not in effect.

IEEE bridge-group in Zone-based FW

Here is a solution for configuring a transparent firewall policy for traffic across bridge group.

Two or more interfaces are configured in IEEE bridge-group and routing to other subnets via Bridge Virtual Interface (BVI). The transparent firewall only apply to traffic crossing the bridge, not for traffic that leaves the bridge-group via BVI.

Configure policy-map to inspect X windows :
conf t
ip port−map user−Xwindows port tcp from 6900 to 6910
!
class−map type inspect match−any Xwindows−class
match protocol user−Xwindows
!
policy−map type inspect servers−clients−policy
class type inspect Xwindows−class
inspect
!

Configure bridge & assign zones to router interfaces

conf t
bridge irb
bridge 1 protocol ieee
bridge 1 route ip
!
zone security clients
zone security servers
!
int vlan 1
bridge−group 1
zone−member security clients
!
int vlan 2
bridge−group 1
zone−member security servers


Configure BVI interface and assign zone security member

!
interface bvi1
zone-member security private