Typical Failover Applications; Introduction To The Failover Mechanism - Avaya G250 Administration

Typical failover applications

Introduction to the failover mechanism

The failover mechanism provides switchover to backup peers in case of remote peer failure. To
enable the failover mechanism, you must:
Configure VPN keepalives, which check the remote peer periodically and announce when
●
the remote peer is dead.
Provide backup peers and a mechanism for switching to a backup in case of remote peer
●
failure.
In addition to the GRE failover mechanism (see
G350 supports several additional failover mechanisms, as described below.
Configuring VPN keepalives
VPN keepalives can dramatically improve the speed with which the G250/G350 detects loss of
connectivity with the remote VPN peer. Two types of VPN keepalives are available. You can use
either or both methods:
Enable DPD (Dead Peer Detection) keepalives, a standard VPN keepalive, that check
●
whether the remote peer is up. This type of detection can be used only if it is supported
also by the remote peer.
Bind peer status to an object tracker. Object trackers track the state (up/down) of remote
●
devices using keepalive probes, and notify registered applications such as VPN when the
state changes. Object tracking allows monitoring of hosts inside the remote peer's
protected network, not just of the remote peer itself as in DPD.
Backup peer mechanism
You can use any one of these alternate backup peer mechanisms:
DNS server (see
●
DNS Resolver capability for dynamically resolving a remote peer's IP address via a DNS
query.
Use this feature when your DNS server supports failover through health-checking of
redundant hosts. On your DNS server configure a hostname to translate to two or more
redundant hosts, which act as redundant VPN peers. On the G250/G350 configure that
hostname as your remote peer. The G250/G350 will perform a DNS query in order to
resolve the hostname to an IP address before establishing an IKE connection. Your DNS
server should be able to provide an IP address of a living host. The G250/G350 will perform
a new DNS query and try to re-establish the VPN connection to the newly provided IP
address whenever it senses that the currently active remote peer stopped responding. The
G250/G350 can sense that a peer is dead when IKE negotiation times-out, through DPD
keepalives, and through object tracking.
Failover using DNS on page 423). This method utilizes the G250/G350's
Failover using GRE on page 416), the G250/
Typical installations
Issue 1.1 June 2005 415