VPN RRI with HSRP
Tom Lancaster
In a Cisco VPN environment, you can take advantage of a couple of features of IOS to create highly reliable VPNs. One problem common in this environment is that multiple tunnels are established for redundancy between the head-end devices and the remote client. This can cause some confusion because the devices will not know which tunnel to use, particularly when IKE (Internet Key Exchange) keepalives are in use.
Reverse Route Injection (RRI) is useful when you have a pair of head-end VPN devices to which many other remote devices establish connections. RRI tracks the active IPSec connection and injects a static route to ensure that the return traffic flows through the same connection.
RRI goes a step further, however. It operates seamlessly with HSRP (Hot Standby Router Protocol) on the pair of head-end devices so that these devices can present themselves using a single virtual address to all the clients. When a failover occurs, RRI tells the peers so that they use the correct tunnel. This allows your VPN to be very resilient.
The beauty of this solution is that you can increase your IKE keepalives (from the default of 10 seconds. Since it takes 3 missed keepalives for a failover to occur, increasing the IKE keepalives without RRI can result in very long failover times.) This lowers the CPU utilization, which increases performance, but the use of RRI and HSRP allow your failover time to be very fast.
Thomas Alexander Lancaster IV is a consultant and author with over ten years experience in the networking industry, focused on Internet infrastructure.
