Redundancy Group Design Question

[aeroplane]

Hi Bill

Thanks for the great explaination. As you mentioned for UTM/IPS, RG0 and RG1+ should be on the same chassis.

1- Is that true for IPSE VPN and Routing over IPSEC?

2- For RG0 and RG1+ on the same node, I will track all interfaces of all RG1+ in RG0? Also should I track interfaces in their respective RG1+ as well?

Thanks

[billp]

1. VPN and routing are done in SPC, so I don't beleive RG0 has any effect here.

2. If you want to be sure that everything (RG0+) fails all together every time, then track all the relevant interfaces in all the RGs; that means you'll fail a chassis if ANY interface fails, but that may be necessary depending on your design requirements.

[aeroplane]

Thanks. It really helped. Do you think is there any special relation or considerations between HA and IPSEC. also HA and Routing.

Thanks

[billp]

HA and IPSec: On failover of the forwarding plane, I believe you have to rekey your tunnels.

HA and Routing: On failover of the control plane, you will have to re-establish adjacencies and recalculate your routing tables.