Typical Failover Applications - Avaya G430 Manual

Typical failover applications

Introduction to the failover mechanism
The failover mechanism provides switchover to backup peers in case of remote peer failure.
To enable the failover mechanism, you must:
• Configure VPN keepalives, which check the remote peer periodically and announce when
the remote peer is dead
• Provide backup peers and a mechanism for switching to a backup in case of remote peer
failure
In addition to the GRE failover mechanism (see
Gateway supports several additional failover mechanisms which are described in the following
sections.
VPN keepalives
VPN keepalives can improve the speed with which the Branch Gateway detects loss of
connectivity with the remote VPN peer. Two types of VPN keepalives are available. You can
use either or both methods:
• Enable DPD keepalives, a standard VPN keepalive, that check whether the remote peer
is up. This type of detection can be used only if it is supported also by the remote peer.
• Bind peer status to an object tracker. Object trackers track the state (up/down) of remote
devices using keepalive probes, and notify registered applications such as VPN when the
state changes. Object tracking allows monitoring of hosts inside the remote peer's
protected network, not just of the remote peer itself as in DPD.
Backup peer mechanism
You can use any one of these alternate backup peer mechanisms:
• DNS server (see
Gateway's DNS resolver capability for dynamically resolving a remote peer's IP address
via a DNS query.
Use this feature when your DNS server supports failover through health-checking of
redundant hosts. On your DNS server, configure a hostname to translate to two or more
redundant hosts, which act as redundant VPN peers. On the Branch Gateway, configure
that hostname as your remote peer. The Branch Gateway will perform a DNS query in
order to resolve the hostname to an IP address before establishing an IKE connection.
Administering Avaya G430 Branch Gateway
Failover using DNS on page 536). This method uses the Branch
Failover using GRE on page 530), the Branch
IPSec VPN
October 2013 529