topic ASA 5505 VPN Failover over WAN failover. in Network Security

ASA 5505 VPN Failover over WAN failover.

John Peterson — Mon, 11 Mar 2019 21:35:42 GMT

Hi,

Hopeing someone can point me in the right direction, I have a ASA 5505 which is connected to a remote site which also has a ASA 5505 over a L2L VPN tunel. One of the sites has a WAN failover configured with two ISP which is working successfully.

But, when the WAN connection fails over to the backup connection the VPN link breaks as the peer site IP address has changed and the VPN can not establish a connection.

Would it be possible to configure a VPN failover so that when the connection failovers so will the VPN tunnel?

Thanks

ASA 5505 VPN Failover over WAN failover.

Jon Marshall — Mon, 10 Oct 2011 15:40:42 GMT

John

When you use the "crypto map set peer x.x.x.x" you can specify multiple peer IPs to use as a fallback list ie. it tries the first IP and if that fails then the next etc. So you could try -

crypto map set peer x.x.x.x y.y.y.y <--- where y.y.y.y is the backup Wan IP.

Jon

ASA 5505 VPN Failover over WAN failover.

John Peterson — Mon, 10 Oct 2011 16:02:01 GMT

Hi Jon,

Would it be also be possible to specfic different interfaces in the crypto map i.e. crypto map l2lsites interface outside and crypto map l2lsites interface outside2.

As the WAN failover would switch over to outside2?

ASA 5505 VPN Failover over WAN failover.

Jon Marshall — Mon, 10 Oct 2011 19:10:44 GMT

Yes you can apply different crypto maps to different interfaces if that is what you are asking but you would need to make sure that if you wanted the traffic to go via outside2 for failover then traffic is routed that way on the ASA.

Jon

ASA 5505 VPN Failover over WAN failover.

John Peterson — Tue, 11 Oct 2011 07:08:39 GMT

Thanks,

would the ASA choose the next interface is it can't connect.

I'm looking to do something like this:

crypto ipsec transform-set esp-3des-md5 esp-3des esp-md5-hmac
crypto map l2lsites 10 match address acl-l2l-ny
crypto map l2lsites 10 set peer XXX.XXX.XXX.XXX
crypto map l2lsites 10 set transform-set esp-3des-md5
crypto map l2lsites interface outside

crypto map l2lsites interface outside_failover

crypto isakmp enable outside

crypto isakmp enable outside_failover

In which case when the internet connection fails over the VPN the ASA would know that outside is down and then its try outside_failover.

I'm right in thinking this is how it would work?

ASA 5505 VPN Failover over WAN failover.

John Peterson — Wed, 12 Oct 2011 13:21:21 GMT

Also how about the tunnel group?

ASA 5505 VPN Failover over WAN failover.

Peter Long — Mon, 12 Dec 2011 15:02:52 GMT

I managed to get it working, like so

Cisco ASA/PIX 8.x: Redundant or Backup ISP Links with VPNs

Pete