ASA Version 8.0(2)

interface Ethernet0/0

  nameif INSIDE

  security-level 100

  ip address 1.1.1.10 255.255.255.0 standby 1.1.1.11

!

interface Ethernet0/1

  nameif OUTSIDE

  security-level 0

  ip address 3.3.3.10 255.255.255.0 standby 3.3.3.11

!

interface Ethernet0/2

  description LAN/STATE Failover Interface

!

access-list OUT_IN extended permit udp host 3.3.3.1 host 1.1.1.1 eq 848   // for allowing registration via ASA through GDOI process from GM1 to KS1

access-list OUT_IN extended permit udp host 3.3.3.1 host 1.1.1.2 eq 848 // for allowing registration via ASA through GDOI process from GM1 to KS2

access-list OUT_IN extended permit udp host 3.3.3.2 host 1.1.1.2 eq 848 // for allowing registration via ASA through GDOI process from GM2 to KS2

access-list OUT_IN extended permit udp host 3.3.3.2 host 1.1.1.1 eq 848 // for allowing registration via ASA through GDOI process from GM2 to KS1

failover lan unit primary   // for making ASA2 as secondary (failover lan unit secondary)

failover lan interface FOVER Ethernet0/2

failover link FOVER Ethernet0/2

failover interface ip FOVER 7.7.100.100 255.255.255.0 standby 7.7.100.101

failover

access-group OUT_IN in interface OUTSIDE

fixup protocol icmp // for inspecting ICMP traffic via ASA

crypto isakmp policy 10

  encr 3des

  hash md5

  authentication pre-share

  group 2

crypto isakmp key cisco address 3.3.3.1 // isakmp sa between KS1 and GM1

crypto isakmp key cisco address 3.3.3.2 // isakmp sa between KS1 and GM2, required when KS2 fails

crypto isakmp key cisco address 1.1.1.2 // isakmp sa between KS1 and KS2 for announcement message

!

crypto ipsec transform-set TRANS esp-3des esp-md5-hmac

!

crypto ipsec profile GDOI

  set transform-set TRANS

!

crypto gdoi group GETVPN

  identity number 123 //should be same

  server local

   rekey retransmit 10 number 2 // default

   rekey authentication mypubkey rsa KEK

   rekey transport unicast // multicast by default

   sa ipsec 1

     profile GDOI

     match address ipv4 101

     replay time window-size 5 //TBAR (by default counter based i.e sequence number)

   address ipv4 1.1.1.1

   redundancy // COOP is enabled

     local priority 100 // should be more than the secondary KS

     peer address ipv4 1.1.1.2 // address of KS2

interface FastEthernet0/0

  ip address 1.1.1.1 255.255.255.0

ip route 3.3.3.0 255.255.255.0 1.1.1.10

access-list 101 permit ip 10.1.0.0 0.0.255.255 10.1.0.0 0.0.255.255 // ACL that will be downloaded on GM's (Intresting traffic)

crypto isakmp policy 10

  encr 3des

  hash md5

  authentication pre-share

  group 2

crypto isakmp key cisco address 3.3.3.1

crypto isakmp key cisco address 3.3.3.2

crypto isakmp key cisco address 1.1.1.1

!

!

crypto ipsec transform-set TRANS esp-3des esp-md5-hmac

!

crypto ipsec profile GDOI

  set transform-set TRANS

!

crypto gdoi group GETVPN

  identity number 123

  server local

   rekey retransmit 10 number 2

   rekey authentication mypubkey rsa KEK

   rekey transport unicast

   sa ipsec 1

     profile GDOI

     match address ipv4 101

     replay time window-size 5

   address ipv4 1.1.1.2

   redundancy

     local priority 50

     peer address ipv4 1.1.1.1

interface FastEthernet0/0

  ip address 1.1.1.2 255.255.255.0

ip route 3.3.3.0 255.255.255.0 1.1.1.10

!

access-list 101 permit ip 10.1.0.0 0.0.255.255 10.1.0.0 0.0.255.255

crypto isakmp policy 10

  encr 3des

  hash md5

  authentication pre-share

  group 2

crypto isakmp key cisco address 1.1.1.1

crypto isakmp key cisco address 1.1.1.2

!

crypto gdoi group GET

  identity number 123

  server address ipv4 1.1.1.1 //primary KS

  server address ipv4 1.1.1.2 //secondary KS

!

crypto map CMAP 10 gdoi

  set group GET

!

interface Loopback0

  ip address 10.1.3.1 255.255.255.255

!

interface FastEthernet0/0

  ip address 3.3.3.1 255.255.255.0

  crypto map CMAP

ip route 1.1.1.0 255.255.255.0 3.3.3.10

ip route 10.1.4.1 255.255.255.255 3.3.3.2

NOTE : GM1 will first try to register to KS1, if KS1 is not reachable it will try to register to KS2

After registration following mess appears:

crypto isakmp policy 10

  encr 3des

  hash md5

  authentication pre-share

  group 2

crypto isakmp key cisco address 1.1.1.1

crypto isakmp key cisco address 1.1.1.2

!

crypto gdoi group GET

  identity number 123

  server address ipv4 1.1.1.2 // GM2 tries to register wiht KS according to the order the severs are defined

  server address ipv4 1.1.1.1

!

crypto map CMAP 10 gdoi

  set group GET

interface Loopback0

  ip address 10.1.4.1 255.255.255.255

!

interface FastEthernet0/0

  ip address 3.3.3.2 255.255.255.0

  crypto map CMAP

ip route 1.1.1.0 255.255.255.0 3.3.3.10

ip route 10.1.3.1 255.255.255.255 3.3.3.1