Which redundancy protocol must be implemented for IPsec stateless failover to work?

SSO (Stateful Switchover) is the underlying mechanism used for stateful failover where IKE and IPsec session state is replicated to the standby, not the redundancy protocol required for stateless failover.

GLBP distributes traffic across multiple active gateways using different virtual MAC addresses per member, which breaks the single-active model that IPsec stateless failover depends on for deterministic peer takeover.

HSRP creates a virtual IP and virtual MAC address shared between active and standby peers. With stateless IPsec failover, when the active device fails HSRP transitions the virtual IP to the standby, allowing clients to re-initiate connections to the same address - existing IPsec SAs are not preserved, so clients must renegotiate new security associations after failover.

VRRP is an open-standard protocol that functions similarly to HSRP, but Cisco's IPsec stateless failover feature is specifically integrated with HSRP on Cisco IOS and ASA platforms rather than VRRP.