Description:
The Administrative distance is used to set up multiple identical static routes to different remote sites. Both routes are permanently enabled. This allows the implementation of simple backup scenarios.
The Administrative distance uses values between 0 and 255. The values 0 and 255 each have a special function:
- Using the value 0 sets the metric according to the defined default values. For this reason the value 0 should not be used.
- The value 255 describes the state when there is no connection (interface down). Consequently, this must not be selected for a connection.
The route with the lower Administrative distance is the one that is selected. If this connection fails, the operating system sets the route to the value 255 (interface down) and the routing entry with the lowest administrative distance becomes active.
The use of the Administrative distance and the Backup table are mutually exclusive
Requirements:
- LCOS as of version 10.40 (download latest version)
- LANtools from version 10.40 (download latest version)
Scenario:
1) Two internet connections are used for redundant operation:
- The connections INTERNETand INTERNET2 are already set up and functional.
- The connection INTERNET2 should be a backup for INTERNET1.
2) At a remote location without physical access, an IKEv1 connection should be changed to an IKEv2 connection:
- An IKEv1 connection is already set up and functional.
- It should be migrated to IKEv2. For this purpose, the IKEv2 connection is set up in parallel.
Procedure:
1) Two internet connections are used for redundant operation:
When using a plain Ethernet connection, you need to set up ICMP polling so that the router will detect a line failure.
1.1) Open the configuration in LANconfig and switch to the menu item IP router → Routing → IPv4 routing table.
1.2) Select the primary connection (INTERNET) and click on Edit.
1.3) Enter a value for the Admin distance (in this example 5).
1.4) Select the backup connection (INTERNET2) and click on Edit.
1.5) Change the following parameters:
- Routing tag: Set the routing tag to the same value as the primary connection (in this example the tag 0).
- Admin distance: Set the administrative distance to a value higher than for the primary connection (in this example 10).
1.6) The modified routing entries should then look like this.
1.7) This concludes the configuration of the backup scenario. Write the configuration back to the router.
2) At a remote location that cannot be accessed, an IKEv1 connection should be changed to an IKEv2 connection:
It is possible to use the administrative distance to set up an IKEv2 connection in parallel to an existing IKEv1 connection. After the IKEv2 connection has been established, the lower value means it becomes active. If the IKEv2 connection cannot be established, the IKEv1 connection is still there to be used. This guarantees permanent access via VPN without the need for an on-site visit.
This procedure is only useful for migrating from IKEv1 to IKEv2 if there is no access to the remote router (either from the local network or from the Internet).
With connectivity assured, the IKEv1 connection can be deleted using the setup wizard Remove remote site or access and set up again using the setup wizard Connect two local area networks (VPN).
2.1) Preparations on the router at the branch site (BRANCH):
2.1.1) Open the configuration of the branch-site device in LANconfig and switch to the menu item IP router → Routing → IPv4 routing table.
2.1.2) Select the routing entry of the VPN connection (in this example HEADQUARTERS) and click on Edit.
2.1.3) Enter a value for the Admin distance (in this example 10).
2.2) Configuring the IKEv2 connection:
2.2.1) Manually set up an IKEv2 connection on both routers. The name of the VPN connection must be different from the name of the IKEv1 connection as the names have to be unique.
Do not yet write the configuration back to the branch-site device!
2.2.2) In step 2.10 in the article mentioned above, the option Router requires the IKEv2 connection to be selected and a value must also be set for the Admin distance. This must be lower than the value for the existing IKEv1 connection (in this example the value 5).
2.2.3) This concludes the configuration at the branch site. Write the configuration back to the router.
