Configuring multiple site-to-site VPNs on a single ASA

[Waterbird]

I'm using an ASA 5506X and I wish to configure two site-to-site vpn tunnels, which go to two other sites with their own ASA's

But the second VPN is not accepting the final configuration step of applying the crypto map to the outside interface.

Why not?

[Rob Ingram · Accepted solution]

Without seeing your configuration or the exact error I can only guess.

You can only have one crypto map attached to an interface, they are differentiated by the use of sequence numbers

E.g:-
crypto map CRYPTO-MAP 1 match address R2_VPN
crypto map CRYPTO-MAP 1 set pfs group2
crypto map CRYPTO-MAP 1 set peer 1.1.1.1
crypto map CRYPTO-MAP 1 set ikev1 transform-set VPN-TRANSFORM
crypto map CRYPTO-MAP 2 match address R4_VPN
crypto map CRYPTO-MAP 2 set pfs group2
crypto map CRYPTO-MAP 2 set peer 3.3.3.1
crypto map CRYPTO-MAP 2 set ikev1 transform-set VPN-TRANSFORM
crypto map CRYPTO-MAP interface OUTSIDE

If this does answer your question please provide your configuration and the exact error you receive.

HTH

[Karsten Iwen]

You can also configure route-based VPNs where all this crypto-map complexity is not needed any more:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/configuration/vpn/asa-98-vpn-config/vpn-vti.html

I would always prefer this VPN-style if supported by the devices.