topic Re: IPSec Tunnel Redundancy Solution in Network Security

IPSec Tunnel Redundancy Solution

zekebashi — Fri, 21 Feb 2020 16:09:35 GMT

Hello,

We currently have a pair of ASA 5510 configured in a failver. We have a Site-To-Site IPSec VPN configured to a remote site. So, hardware-wise, we have a fail-over solution but not a logical one where if the IPSec tunnel were to fail then it would failover to another tunnel. Is there such solution? Are are any recommendations to mitigate IPSec Tunnel failures provided that the primary ASA and the link to the ISP are operational?

Thanks in advance.

~zK

Re: IPSec Tunnel Redundancy Solution

Rob Ingram — Tue, 28 Aug 2018 20:54:01 GMT

Hi,
You can define a backup peer ip address on the crypto map, which would only be used if the first peer ip address is down. E.g. - "crypto map CRYPTO_MAP 5 set peer 1.1.1.1 2.2.2.2"

HTH

Re: IPSec Tunnel Redundancy Solution

Ajay Saini — Tue, 28 Aug 2018 20:56:32 GMT

Hello,

Are you considering a scenario wherein you have dual ISP and you wish to fall back to second ISP for vpn tunnel if the primary ISP fails, then yes it is possible:

It will be similar to :

https://community.cisco.com/t5/vpn-and-anyconnect/cisco-asa-dual-isp-vpn-redundancy/td-p/1723979

If you have any other specific failure scenario in mind, please let us know.

Regards,

Re: IPSec Tunnel Redundancy Solution

Alex Pfeil — Tue, 28 Aug 2018 21:01:50 GMT

You may also be able to setup the firewalls in multiple context mode in an active/active state. You could then build an IPSec tunnel from each ASA through the two ISPs and have both tunnels up at the same time. Depending on your routing, you could send some traffic one way, and some traffic the other way. There are some caveats with multiple-contexts, such as you cannot have the same vlan between contexts.