A method for deploying two Cisco CSR 1000v in a redundant pair with failover between them, is summarized below. Also see How to Configure High Availability for further details.

Errors that may occur during route replacement (for Cisco IOS XE Denali 16.3.1a or later) are shown in the following table.

The following figure "Initial Topology and Traffic Flow" is an example of a VPN gateway configuration that is deployed in two availability zones in a single region, which is a widely used deployment.

This topology uses multiple availability zones and four VPC subnets.

For this scenario, each CSR 1000v is launched in a different availability zone and has a primary Ethernet interface (GigabitEthernet1) that is assigned to the public subnet. The public subnet has a VPC route table with a default route target of the Internet gateway.

Each CSR 1000v also has a VPN tunnel to the internet. These tunnels typically terminate at another VPN device that is located on the enterprise network or another VPC.

To support the high availability solution, configure a GRE tunnel between the local CSR 1000vs. A GRE tunnel allows each CSR 1000v to exchange the BFD control packets that are used for peer failure detection. The GRE tunnel is established using Elastic-IPs of CSR to avoid the DHCP lease renewal triggering false failures.

EIGRP is used as the routing protocol, though other routing protocols could be used. The primary purpose of the routing protocol is to register as a BFD client. BFD requires at least one client protocol before it initiates neighbor discovery. An extra benefit of the GRE tunnel and the routing protocol is that they can be used to establish a back-up path in case of VPN tunnel failures.

The EC2 instances in private subnet, has its own VPC route table. The default route for this subnet has a target of the public subnet network interface (GigabitEthernet1) of one of the CSRs. Since the CSR is not directly connected to this private subnet, it is recommended to add a static route for the private subnet to each CSR. This static route points to the address of the VPC router on the public subnet. This address is always the first usable address of a subnet. For example, the VPC router address for the subnet 10.0.0.0/24 is 10.0.0.1. Because the VPC route table only allows for one active target per route, only one CSR is in the egress traffic path for this subnet. The remote VPN devices determine the ingress traffic flow over the VPN tunnels, so that it is possible that CSR-B is the active ingress path or that load sharing is being done between CSR-A and CSR-B.

CSR-A then fails, as shown in the following figure "CSR-A Failure" The goal is to shift traffic so that it will egress through CSR-B and no longer ingress through CSR-A.

For the ingress traffic flow, the remote VPN device detects that the VPN tunnel that is terminated at CSR-A is no longer available, by using high availability techniques such as routing protocols (with or without BFD) and IKE dead peer detection.

For the egress traffic direction, CSR-B detects the failure of CSR-A and modifies the VPC route table to redirect traffic to CSR-B.

When BFD times out on CSR-B, a log message similar the following is generated.

%DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 10.0.0.3 (Tunnel33) is down: BFD peer down notified

For Cisco IOS XE 3.16 or earlier, EEM is an event detection and automation technology that is available on the CSR 1000v. The EEM applet is configured to run whenever the BFD peer down log message is generated. When it is triggered, the EEM applet uses the AWS API ec2-replace-route command to modify the VPC route table to make itself the new target for the default route. See the following figure "CSR-B Modifies the VPC Route Table".

For Cisco IOS XE Denali 16.3.1a or later, use the cloud provider aws command to detect the BFD peer down event. Configure the CSR 1000v using the cloud provider aws command. This command defines the routing changes to the (VPC) Route-table-id, Network-interface-id, and CIDR when an AWS HA error, such as the BFD peer down event, is detected. See the following figure "CSR-B Modifies the VPC Route Table".

After the VPC route table is modified, the EC2-instances in Private Subnet-1 begin directing egress traffic to the CSR-B, as show in the following figure "New Traffic Flow Through CSR-B".

For further deployment and configuration information for a CSR1000v on AWS, see How to Configure High Availability.

Verify that the BFD and EIGRP relationships are established and normal on both peers. This example shows the local peer on Tunnel 33, and also the remote peer on Tunnel 98.

Router# show bfd neighbors
IPv4 Sessions
NeighAddr                              LD/RD         RH/RS     State     Int
172.17.1.2                           4097/4097       Up        Up        Tu1 
Router# show ip eigrp neighbors
EIGRP-IPv4 Neighbors for AS(1)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   172.17.1.2              Tu1                      11 02:02:31   19  1470  0  7 

For Cisco IOS XE 16.3.1a or later, the following two additional verification commands are available:

show redundancy cloud provider [aws | azure ] node-id

debug redundancy cloud [all | trace | detail | error ]

Example:

Note	In this example, the show redundancy cloud provider aws command produces output that includes: "Cloud HA: work_in_progress=FALSE"—you can ignore this message.

show redundancy cloud provider aws 1

Cloud HA: work_in_progress=FALSE
Provider : AWS node 1
        State : running
        BFD peer     = 172.18.1.2
        BFD intf     = Tunnel5
        route-table  = rtb-30535b54
        cidr         = 172.33.0.0/16
        eni          = eni-4527b83a
        region       = us-west-2