topic Re: FMC Site to Site VPN Question in Network Security

FMC Site to Site VPN Question

dcanady55 — Mon, 05 Dec 2022 20:21:08 GMT

Hello,

I've been reading through Cisco's site to site documentation and wanted to confirm there's no possible way for a site to site vpn to have both tunnels active? Seems you can only have active/passive.

FMC 7.0 using FTD 2100 series.

Thanks in advance

Re: FMC Site to Site VPN Question

MHM Cisco World — Mon, 05 Dec 2022 20:27:33 GMT

you mean initiate/responder ??

Re: FMC Site to Site VPN Question

Marvin Rhoads — Tue, 06 Dec 2022 12:59:27 GMT

It isn't clear if you are asking about S2S VPN with an HA pair of FTD appliances or a single FTD appliance with a primary and backup S2S VPN peer.

Either way, the answer is "no".

Re: FMC Site to Site VPN Question

tvotna — Tue, 06 Dec 2022 14:40:04 GMT

@Marvin Rhoads, are traffic zones still not supported on SVTI tunnels in case of FTD? On ASA it is certainly possible to configure them and achieve ECMP over tunnel interfaces or use them in a primary/backup manner.

What is not clear though, is how existing connections are reclassified if one of tunnel interfaces goes down in such scenario.

Re: FMC Site to Site VPN Question

Rob Ingram — Tue, 06 Dec 2022 15:33:32 GMT

@tvotna seems like they are now supported from 7.1 and higher. - https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/730/management-center-device-config-73/routing-ecmp.html

Re: FMC Site to Site VPN Question

Marvin Rhoads — Tue, 06 Dec 2022 15:38:06 GMT

Yes - I believe the recently-introduced route-based (VTI) S2S VPNs along with ECMP are supported. Policy-based (crypto map) does not support it.

I have not tried it myself yet though.

Re: FMC Site to Site VPN Question

dcanady55 — Tue, 06 Dec 2022 17:52:22 GMT

Hi Marvin,

Currently, we only have the one FTD in place but soon will have a second FTD setup in HA. I will read up on VTIs and see if those will work in our scenario. Thanks