VPN high availability I'm going to run it says IP between Node 2 in our face right.
If I'm running this IP.
Both of them will not be active at the same time one will be active and he'll be responsible for this
virtual IP.
The default gateway from here will not be to the physical address if I will not be to the physical address
a firefight.
It will be to this one virtual IP and many opt out for this virtual IP out of these two devices the
one which is active will be the one who will reply to that.
So leave it to the package will be moved like two if I do is active I'll do the same redundancy on disabled
little redundancy on this side also so from here also a default out will be pointing to a virtual IP
off to 45 to 54 then I have two IP which will IP is on two different interfaces so if I do goes down
if I to goes down I 5 should be become the active.
The address will still be could be the same but now I 5 will respond with his mac address to decide
to drop it is from this that is your SSN but now what do I want to do I want to create a tunnel an IP
SEC tunnel from here.
This will be the source what will be my destination on the tunnel
the virtual IP I won't create the tunnel with this interface I will not created with this interface
I created with this virtual interface who's gonna act as the virtual interface the one who is active
so the active days he's applying to that interface the tunnel at that time is between this and this
if this is the active way guide the tunnel is between this and this the tunnel is decrypted here and
then you're actually days you're inside is here so both of them can teach you that that's not an issue
I'm just having redundancy in Second It's called High Availability scope I will be we will do that because
we'll consider this guy as B as our prime so if he goes down and he comes back up again we give him
the power up and then he comes back up again he'll become the active he'll become the active.
Right.
Let's do this let's configure standby at just IP is called standby I have done the IP already I've not
done this just had me by now configured I do an hour cipher pinging he can reach this guy this site
and he can also read this.
Similarly our faith can reach this side of the network and decided that it has verified that being tendered
one dog one twenty five the network between 1 2 and 5 not one can eat each one.
Yes.
You reach our fight from this which he can come to for faith.
Can you reach ah for.
Yes he can.
Can you reach our faith.
Yes.
So he's able to reach him and him him and that's all I have done.
There's no default out here.
There's no default I would get a debt for now and configure it anyway.
OK now check this out.
I'll do this on our first is what do I do.
I want to do redundancy on which interface have zero ones that on this side of 0 0 that I'm saying I
want to do it first here.
I load on both but I want to do first here because the VPN tunnel will be between this and this.
Basically the same.
So let's go to that interface
interface that 0 1 standby.
Group number.
The group number should be the same send by one IP address.
What is the IP is going to respond to then.
1 245 dot 256.
It overlaps with aphasia.
What does it mean by that.
IP interface vs 245 0 0.
Not 245 interface f 0 1 should be IP address would be 10 1 125 250
not IP address
stand by one IP the IP which it responds to is 125 dot 54 I was doing it wrong I was putting this address
on this interface to the network should be the same right.
The second of the other things are the same which I've done and I just have to stand by one the default
priority is hundreds so I leave it as I've given the power to pre-empt what are the other options that
I have I can have a virtual mac address so both will reply with the same address but I want that right
now I'll do tracking you know what tracking is I'll track the other interface which is F is using this
means if this interface goes down I'm tracking this interface if this interface goes down I lose priority
is reduced by then.
Right now his priority is to define his priority will be reduced by 10 so I'm making sure that if I
do goes down obviously he'll be and he'll go to this site but even if this interface goes up his priority
will go 90 what should be the priority on this guy.
95.
More than 90.
So the moment the priority goes down on the top down there are five people.
I don't have to ring the bell.
I'll do it by itself.
I'm doing box level redundancy as well as into space level.
If not the interfaces also goes down.
He will pre-empt and go to the other right.
Done this standby is configured and I.
Is there anything else.
Name the redundancy through redundancy we didn't you.
I'm sure you haven't done it in switching this but you should have a name for your group.
I know it's called Group 1.
I won't name it as a VPN high availability the standby group is VPN high inhabited by default it names
it as bot interfaces FAA 0 0 2 0 1 or something like that.
Right now I'm naming it as both my my choice so I can use it later for state full failure I'll only
use it when I'm doing the states with this remember that I did this I named it VPN It's a what are the
comments
then anything in pardoning you
the first thing I did is interface if a 0 1 Stand 1 I'd be used and 1 1 125 250 then apply for this
standby one I to set the MPT I'll also say the priority as default because I want to change it on the
other guy's priority will be the default off 100 standby one name VPN to stand by one track the other
interface
drag the other is this is all I'm doing on 2 on I 5 Do I need to do the same thing I do need to do the
exact same thing except for priority on that guy should be 91 1 more than 8 you can have anything between
90 and it should be less than hundred greater than 90 Why.
Because when the interface goes down that guy's priority will become 92 they should make sure that I
am more than less than a hundred because I don't want to be the extra right copy this will be I face
to face I want is one hundred five is this the interfaces same F is
OK so this is the family.
No no.
Means if if his priority is high he will take control as acting pre-empt means take control.
Priority means you have the power to take control but to take control you need that command culprit.
You need both.
If your priority is less and you do apprehend it will not work because you don't have the resources
to do it.
Is useless.
If you don't have the BMD command then then then the Automat.
This is what you do with the preamble you guide him.
If you have the higher priority you take control.
Otherwise it will not.
It's weird but not you need to provide him with the option of pre-empt.
They control
send maybe this standby means ie this group would have one will you bite off then 1 125 died 254.
That means if you get an arc they will check right now.
are being sent between this guy and this guy.
You can even see those back as they call it just have two packets
that they work on a multi class address off to Guinea for 0 0.
And remember what is an address but it's a multiply service just like USPS routing protocols.
These are known to many voters.
They're sending hellos among each other making sure that data life if one goes down his hellos will
not be received see the other guy become active.
Right now what's happening is both of them are part of the same standby group of one.
If you check the command show Stand by one will be active one will be.
This guy is what
the MAC address is.
This is what the other guy will be.
Stand by because his priorities low and he does not have be and he has been.
But they are like no no.
The MAC address is the same but he is standing.
Both are part of which address is a virtual address.
Both are part of the service.
Which means if an hour comes here saying I wanted the address of then not one but one 25 to 54.
Who's going to reply to that.
The active guy and both of them know who is the active.
He will get the same job.
He will not reply because he knows I'm stand by.
I favor no reply because he knows I'm standing by.
I do know as he's active so he's supposed to reply.
He will reply that he'll either one will receive the MAC address of whom I do so he will send it back
to
where it's a virtual Mac obviously it will not show us an indifference it's a virtual address where
no you don't have and type it out but this guy here he has the physical address I've given it.
You should communicate because the hello packets go from that physical interface for them to talk to
each other they should have an IP address as Hello packets need an investor go and come back.
Yes
the group should be the same loop.
It's coming out as a multicultural just have to wait for the user to have been sent out here and here.
He's not running it just happy he's dropping it on led to someone like multicast he's dropping it too.
He's the only one who's receiving these facts
right.
I one needs to be given a beef now out what is the default out here going to be
then no one not wondering if I've got to fight for that word will I be anything get.
First let's check if it's bringing in more than 1 25 250 does it apply to
does it pay because he's activated.
The only difference right now is I need to do the same thing on the other side.
But the one difference is I will not have the name for it I do not require the name because I'm not
running a VPN tunnel I don't require redundancy on that site.
I would like to get a name.
The only thing is the IP that he's going to apply to will be the same.
The priority will be the same because this guy is going to be the actor for God sakes.
Have a lighter quite a name so remove the name and the tracking will be of the other interface from
this side the tracking will be on this interface from this side the tracking will be of this interface.
OK.
Do the same thing here.
Copy this was the one difference regarding priorities.
Ninety one on this site.
So this side also goes down he will still
right.
So stand by will be configured on both sides to do this on our faith
made a mistake should not be one.
Number one the group number should be this
is the IP is also different.
The group number should be
yeah.
Let's see if this is OK.
And I do also the same except for
take this out.
He became the deactivated but now he became just came in to speak.
Why.
Because the other guy came up.
He will become the actor.
I will become the time for both groups from this side.
Even on this side.
So he is stand by our faith for which group we look to and I do a group who is also active the group
one is also active chosen by
so is an active on this side replying to to 45 to 54.
And on this side applying to 125 Dr.
I do is active on both sides will apply for this and apply for this I've configured it in a way if this
dies even on this site i 5 will apply for this as well as this because for a group to also this will
become active group 1 also.
This will become active because of the tracking again.
If this interface goes down group 2 is done will become active.
But since this interface goes down he's tracking which one group one to the priority will decrease.
This guy will also become active in the apply for this as well as this
right.
In this you can but you have to do it separately as a different module it's a whole new thing escalate
rapidly it and escalate then tracked that isn't it tracking like this is only one interface but using
SLA you can do it from within.
And the second thing is we don't know what
for incoming for that you'll have to create the here.
This site should be active and decide that this of will have to pre-empt this.
The group number for me I should be this active and for the other group.
This should be the active.
Right now my job is not that my job is not even this My job is to create the my objective is traffic.
Let's let's see if our fault capitalism is Manziel BP make us deal BP not an intersection.
Right now our four should be able to bring home this and the goal was a plan will be to Australia
10 1 2 4 5 2.
So I'll also have a different outcome here than 1 to 45.
He should be able to beat then 1 1 5 1 which is 1
it's going to be like coming back to Michael's
my job now is to configure the traffic going from this to this but the download should be from this
point to
this point to this point.
Right now I do does not know about food excellent I do does not know about one dog one so I'll have
to give him that out.
Same for dog for his year one dog one is that when he gets a packet from there he will have to do it
here as well as you because right now I do is to blame but if I do dice I'd say I should have that out
those
take this up being put off or therefore therefore not possible being one no one no one no one not much
I'll have a I beat out Bulldogs does as you know some 10 1 1 great if I've got one not one for two forty
five died and the other one will be
but this will be the same with Bing Bing Bing
one no one no one
yeah did I create the loop icon
I have create the new back and I think twenty five do to continue with the source food bank of 0 account
I gave it wrong route
Yeah and it didn't give a wrong
okay.
You understand the difference.
Well done for it can also be this one that one can ask this because when I have the match access list
I'm doing it from my do right.
So he should at least have access to him if he's not able to provide the packet back.
Good bulldog for you to use this same thing on our face.
Whatever I do on I do should be replicated.
So this
is not a firewall.
Not the context.
So is it also not one
same thing wherever it is on our food should be I think a good way of doing it.
We don't like to copy the configuration.
Basic is everything is the same except for that for.
Separate so done.
For now we have standby.
My job right now is to create the time I do it on.
I do this now I copy it on my face.
If you see the difference lies OK let's create an access list first let's do the normal stuff that we
do crypto.
I said Can policy that encryption lead us authentication appreciate hash and design group to crypto
say again please Cisco addresses 125.
That one is number two but I do it will be the same ones interface because the tunnel will be created
from that public interface that
the IP SEC transforms said he said PSP two days USP and.
Then access list.
What is the storage going to be the source is going to be coming from here.
For him it's coming from here.
So for that for going to know if this topic comes in and match it and the so I do what I do doing it
on that note that's a permit IP
going to
right then crypto map a map then I'd be safe.
I see that there is one twenty five that one then said fast bomb that he said match the address.
Then this is where the difference lies interface.
If a 0 1 0 0 0 1 1 0 0 0 1 0 1 I'll do this.
So until now everything is the same.
Copy paste it on to
the largest.
The only difference lies here.
Tip toe map a map.
I used to say enter.
I want to enter as it attendance and name it.
What was the name on my stand by group.
It was called VPN.
It will be in Egypt.
Basically I'm telling him hey listen you're doing crypto math at the same time and you're applying the
crypto map check in your VPN it.
Are you the active one.
If you're not the active do not send the traffic.
I do not receive any traffic.
You have to be the active for you to work.
That's what I'm telling him their.
Right now I do is active so no problems with the same configuration.
Copy paste with my face.
Same here.
Same here and even here.
Which one VM.
Yes it will be on both sides because priority date depends on priority I boost the is low.
Even if he has been both I see both are pulling
VM means you have the power to fully right now both of them are pulling to become the active say there's
a card in the mini.
There's a road both of them are pulling under one guy's muscular over 100.
The other guy is 91.
Who's going to be it is going to be the means book.
If you don't know him the muscular guy is 100.
The other guy is 91 but he's active and he doesn't have the pre-empt the priority hundred to get the
muscular guy.
You have not given him the ability to pull so it says they're standing on the.
Obviously the active guy is going to stay active.
And even if you have not configured him and he becomes active because when he ran down that that became
active.
If he comes back I mean he's not pulling.
He's not gonna become.
Yeah.
That's what I'm telling you on this today.
If both happy and both will pulled then it began.
Depends on who has the other who is also pulling favors over.
The only thing is when I lose one arm will die.
One loop that will work will go down.
His arm is down right.
His priority will reduce a strength will not be handled it will be 90.
The other guy will be 91 so he'll pull him.
That made sense.
Let's go to Isaac and policy everything is the same.
I'm just copying it to my flight.
Crypto map.
A map.
Done Nancy VPN.
It's created the same name heroes it does.
Right.
I've done my first half of the done here also as well as here but this is active.
So he's the only one who's gonna play.
We'll go to i1 do the either side of the time.
I'm not on the other side.
Don't think I copy pasted itself.
And feed our to compete.
The only difference is some things will change which are this one this is what is this going to do the
virtual access IP the words will IP not have I do not if I find here access this will be reversed.
Yes.
254 everything will be the same at 0 0 tiptoe map a map.
There's no redundancy on this.
I want a standalone
based
if map and I've noted in its tallies up they work.
Was to blame.
Where the traffic going.
Going for my night.
I'd say by doing I pay just
might bring I'd do dumb but I won't shut it down.
I'll just go to one of the interfaces and turn it off.
Shut up.
Check out what happens.
With one group do both became the standard group one as well as group two.
And this five became active in both groups.
So now he's not only responding to this I say this.
He's also responding to this.
Now he's active in all senses but the problem is this will not work.
Why.
Because this tunnel was established when it was established.
It was established to do I need to it down.
I need your data down first then bring it back up again.
Where's it going from.
That's going for my friend.
Right.
So whoever was connected to the Internet died for them.
What they have to do is disconnect and back up again fade away.
Does that mean if I go to I to
interface f 0 1.
No -- I do this pre-empt is enable a standby to activate standby to activate on both the groups he's
active.
This guy
won't go to our fight even because now even the IP has to talk.
An not to back it.
It seems that a message has no initialization for life because he's trying to go from now.
But the tunnel is established.
IP SEC also moved up IP SEC moved to I too I find he's not going to respond like SEC anymore but the
session was established with 0 5 so I need to clear it again where I want
clear to say and I see and again.
Going from
where there is between 1 and 4 I do and I find it is
that a state full and state central and state but when the interface came up I didn't become the active
duty.
Yeah.
If you don't put the end obviously faith will be the act of way they do it.
So if you don't do prism.
If both of those are the same both can get into the same amount of law.
Both can get the same amount of load.
Both are identical copies of each other and it's okay for this to be active also.
It's good to not do the print because then you're not going to pre-empt your traffic will be going from
here.
Right.
So he will stay with a will also stay here as well as you just heard the act of.
So no problem.
Right now he's taking the charge so that's why the town that was going through here does not work anymore
because I could become the active
he will always take charge if his priority is law.
His priority is how evil always but his priority should also be a priority is lower than the other guy.
You pre-empt he will not be and this is hundred.
Yeah.
Okay.
You don't just be about 50.
It's okay.
I will always come back.
I will always take charge.
But the problem is.
Yeah who.
I do.
Situation is put out there will always be a hundred you will always have to be and I do will always
have to.
It will always have.
I will always be pulling you no pre-emptive to take.
It's not about leaving.
Yeah definitely but e-mailed.
Check this out.
The face f a 0 0 standby 1 this is being spammed so our 5.
I want to do interface f a 0 0 1 0 0 0 0 1 so 0 one no standby.
1
so stand by.
Let's let's check the emission is disabled.
The Amazon is disabled right.
So there isn't any evil on this say.
Then we'll set that up and bring it back up again.
I do.
Interface FAA 0 1 0 0 0 because of tracking
goes right it goes down.
It became active good to do but he didn't become active.
Why.
I do not take sides.
It does not have the pre-emption enabled the priority on what went down became what.
Ninety two is 91.
But he does not take sides for group two.
He didn't give out the touch even if if you want to see this also stand by to say no to this.
But I have disable pre-empt until I interface FAA 0 1 0 0 more said
which I set to work.
Yeah.
This had to interface up a little one I did this.
Nice should none other than that.
This one should be brilliant and this one should be preempt and would remove that the empty
then both the beam should be disabled as it were here the invisible.
Yes I do has not been one has been in both.
Sorry I should have been in both chambers and able here the is enabled.
Now when I do whatever goes down I 1 5 will take backup but when I do comes back up you should be able
to pick charge again.
Zero one shot
goes down speak goes down right.
I do has taken back if I had taken back only for that interface what was the active went down.
He didn't take back for the interface for the tracking.
That's OK.
That's all I wanted to check if I do know that this comes back up and it becomes
twisted in that initialization is listening giving them day
interfaces down.
Yeah.
The interface doesn't come up.
Yeah yeah but he is been is preempting anything from this.
On the other side.
He will not leave controlled
the emotion is disabled gluten is what he is active for this and for this site is is active for both.
So I guess the PM's and should be an evil it doesn't work for me working under one site because he's
not taking charge.
The interface is done as infused as administratively done.
You didn't become active active active in both
the happy m you can pull you don't happy yet.
You can't.
It's not about him not living charge.
It's about the other guy was
the only thing is if you give the arm from the other side both are going to pull.
But it matters which side has more strength and the strength is for your
right now.
I have messed up my tunnel a lot so let's play the clip to see.
And I say okay.
Now the thing I want to show you it's working properly.
This is redundancy.
You liberty.
The only problem is stateless the state fool does not work with 80 percent of the IRS as the GST does
not.
But we still configure it.
I told you how to configure it.
It's really really easy if you just remember the first two comments.
After that it's only one command each with the question mark which will lead to
the commands are really simple.
I do it's called redundancy which redundancy in the device.
Enter you go inside scheme not.
You can provide security also for this using an IP sector standby because you can only provide redundancy
to.
OK and what is the safety group VPN into.
So provide redundancy to this group of.
OK done.
Yeah the command is IPC zone APC zone defined in here.
Then you do that.
Ask of the staff association any IP question mark protocol.
This protocol do you want.
So that I do an hour five talk and exchange their IP sic information.
The one protocol that does that is gone SDP.
The only one reason why this protocol is there is to enable that state change between the two.
So I'll give you one my state you give me my your state of the connections it's not a good thing to
keep this as open.
That's why you have that security because it defeats the whole purpose.
All your IP traffic is going to be open.
If you don't secure this on that redundant link it's a good thing to do a secure security there but
it doesn't work this way so you decide not to do security on Saturday if it works.
Okay done.
Protocol is a city to go inside this mall also I have a local port and the remote would have to configure
both as GDP does not have its own board members you'll have to specify which port you want to work on
as a local port.
Anything anything which I want does it for 4 4 4 enter.
I would also have to provide some more options out of these options I could provide a local IP.
What is my local IP twenty five.
Got two.
It's confusing right now.
Once you do it it's Philly's exit.
The other one is the motorboat for 444 for same.
The more I use it on the same source port and Destiny support.
The Maldives is what
safe because I'm talking about it.
That is all I have to do for now.
One thing I have to do which is to face it apply my craft on my phone.
0 0 0 1.
I'll remove it I'll put it back up again.
I said redundancy with VPN.
I also have one more command card.
State for state full uses this zone IPC zone but high availability so state.
He says it will not work if this is not the active which is OK.
It just gives you a message saying you will not work if you are not active.
That's all right.
I look the same steps again I could have copy pasted but I want to show you the steps again.
What is the first step.
Redundancy in the device then scheme.
Standby.
What is the name.
A standby so it gives you that method takes it.
The other thing was IPC that's all the rest.
You'll just have to remember IPC zone defined question mark association with any idea then workable
protocol.
If not it's local slogan as ADP then local board.
Same
local IP if I died 5 on this except the more bored we are.
This should be this.
Then no wonder 125 that exit exit exit exit interface.
FAA 0 1.
No crypto maps.
Crypto map.
A map redundancy VPN to add
show to its short attendance showed attendance and.
It will not take effect until next reload.
You need to reload for it to take effect although it will not take effect either but will still reload
and see what it shows it shows you the configuration.
But a lot of ISIS does not work properly.
I've done this.
Turn it off.
Both of them
bring it back a bit for some time.
Bring it back up
and hope that it doesn't die soon is up and God.
This one is
none take the same command again.
This will be speaking so I wanted to take sure that I save everything properly.
Anything is lost.
So.
Yeah it's coming back.
All right.
This is what he says crypto IP sic as a high availability status is
high availability status for us at this stage will fail.
But this guy doesn't show anything.
He's going he's still going to be stand.
I just hope he's a slow learner.
Later they came up with VIP which was much faster because the yellow packets were sent very quickly.
Three point one two seconds was the daytime and this IP was very slow as compared.
So let's go here.
Sure.
Redundancy entitlements.
The state is active.
Security I'm not configured you can if you want.
You're most welcome.
From this guy also show redundancy entitlements stand by the other guys at the there's this state fellow
right.
The protocol that they're using is a city.
Am I doing it on this.
This is the only one.
It's working on this site right.
0 1
is close by.
Captioning
advisor.
Southampton.
Michael
this is a city who sends them hard beats de da acknowledgments cookie a go at there's a lot because
it's expanding very vital information.
Hard is the back of a sense that it's like a hand of the city say
what is the source good.
This isn't book and big chunk.
This is text.
Right now it's blatant.
Right now it's clear that I'm not change anything in that it's getting out at
44.
For me that's for the heartbeat.
I'd be the guides one for the normal day nights for four.
OK now let's do our food medicine.
It's great that I'm
I foresee.
I once I got an answer straight from my one degree in the town.
Do everything go to one of the towns.
It's not happening.
They changes to something not save
and then if I die before
tapping 245 that for
news again.
So why can't I go to the source to back off.
Those who back others you
know you.
I did Clay and said I got beyond that.
Maybe that is the collective and Bhutan's
name is going through right.
My session is fine.
What I do is an outlaw line.
We divide.
0 4 in.
This is a clear telnet session
with a source interface off to.
So this is all going through my is going through the back this session and I'll go do I do the face
interface aphasia one shot
this is what happens
it dies
it dies everything just freezes up both of them are frozen because the redundancy doesn't do it properly.
So if I 5 is alive how 5 is also a day we get they're talking using a CTP there's something wrong with
the ACTU which works on gems we can communicate properly it elevates is very very high time they'll
work but here it says that the hardware cannot take care of them but that's what's going to happen.
He's going to preserve the session on the other side as a session will not break
probably yes.
Probably as right.
This one not really you don't really have redundancy for IP sex don't really need it.
Guy basically is just as unstable as maybe if you connect to disconnect and then you go back home you
go back home you connect and you disconnect like that is not used for video streaming or telnet session
or something like that and so you don't really use it like that.
But yeah if you want to have something which is very critical and should always come through the tunnel
then probably but really you don't like for real time.
Not much to get done.
Let them die let them stay as they are.
Have you seen the real running configuration of adapter.
Sure I know that Sony.
I might show you something.
This isn't how much.
Why not.
Political little
one that is.
Yeah.
Still
a good day.
Maybe on 7 to 200 is more than right here.
Is this something you'd wonder.
It shows you more more features but for now these ones remember we did this.
Most of these scenarios we did some of these and most of these they serve as proper password encryption
timestamps.
We did sequence numbers on the interfaces we did more stuff
in the easy to see why it's a good thing.
Yeah.
The same uses apply to simply just have certain features I going to use USPTO as analogies.
This hashing mechanism has just created automatic because he knows the source and destination.
He knows I'm using a CTP just as truth is like SPF Blue's entry I would like describe what it was to
be about entry is automatic.
Haven't seen it yet and see no SPF wasn't in I believe 6 apb 6 always be available for security you
haven't seen it.
We have been able to
deficiencies that because
it was easy the HPV 6 that's HPV since
it was
HPV is accepting is not happy sex.
We need that starting every year six out obviously of one.
Then you have this option of securities since I've been to this
SPF.
You have authentication a basic SPF number you provide 256.
Then you have to provide a matching mechanism.
Sure you have to provide a key so I can send zeros the scope.
Now the key should be exactly 40 characters.
Not exactly for the characters but your key for this.
So.
So 1 2 3 4 5 6 and 9
three times three 9 nine times 27 30 33 36 39
was paired with me.
That the notion down and something stole your hello packets are actually IP SEC protected actually IP
SEC protect
usually remember before we used to do any face action but here it's a basic protected must have these
questions and you write an exam you have repeated authentication on me with this we finish our VPN VPN
section on that Iris.