User`s guide

Chapter 10 IPSec VPN Config Screens
LAN-Cell 2 User’s Guide
249
Otherwise, the LAN-Cell must re-negotiate the SA the next time someone wants to send
traffic.
" If the IKE SA times out while an IPSec SA is connected, the IPSec SA stays
connected.
An IPSec SA can be set to nailed up. Normally, the LAN-Cell drops the IPSec SA when the
life time expires or after two minutes of outbound traffic with no inbound traffic. If you set the
IPSec SA to nailed up, the LAN-Cell automatically renegotiates the IPSec SA when the SA
life time expires, and it does not drop the IPSec SA if there is no inbound traffic.
" The SA life time and nailed up settings only apply if the rule identifies the
remote IPSec router by a static IP address or a domain name. If the Remote
Gateway Address field is set to 0.0.0.0, the LAN-Cell cannot initiate the
tunnel (and cannot renegotiate the SA).
IPSec High Availability
IPSec high availability (also known as VPN high availability) allows you to use a redundant
(backup) VPN connection to another WAN interface on the remote IPSec router if the primary
(regular) VPN connection goes down.
In the following figure, if the primary VPN tunnel (A) goes down, the LAN-Cell uses the
redundant VPN tunnel (B).
Figure 152 IPSec High Availability
When setting up a IPSec high availability VPN tunnel, the remote IPSec router:
• Must have multiple WAN connections
• Only needs the configure one corresponding IPSec rule
• Should only have IPSec high availability settings in its corresponding IPSec rule if your
LAN-Cell has multiple WAN connections