Comment
Author: Admin | 2025-04-28
Peer establishes the SA. In cases of disrupted traffic, a manual trigger is needed to initiate the IKE SA with the next peer. IKEv2 Responder Behavior If the responder device of IKE SA is configured with multiple peers in the crypto map, whenever an IKE SA is attempted, the address of the initiator IKE SA is validated with that of the current active peer in the crypto map. For example, if the current active peer in the crypto map (being used as Responder) is the first peer, then the IKE SA is initiated from Peer1 IP address. Similarly, if the current active peer in the crypto map (being used as Responder) is the second peer, then IKE SA is initiated from Peer2 IP address. Note Peer traversal is not supported on the Responder Side of a IKEv2 multi-peer topology. Peer Index Reset Upon Crypto Map Changes Any change to the crypto map resets the peer index to zero, and the tunnel initiation starts from first peer in the list. Following table provides multiple peer index transition under specific conditions: Table 1. Multi-Peer Index Transition before SA Conditions prior to SA Peer Index Moved Yes/No/Reset Peer not reachable Yes Phase 1 proposal mismatch Yes Phase 2 proposal mismatch Yes DPD ack not received Yes Traffic selectors mismatch during AUTH phase Yes Authentication failure Yes Rekey failure due to peer not reachable Reset Table 2. Multi-Peer Index Transition after SA Conditions after SA Peer Index Moved Yes/No/Reset Rekey failure due to proposal
Add Comment