ftd full mesh vpn with backup lines

[Spyros Kasapis]

Hello

is it possible to create full mesh vpn in ftd with backup lines ?

[balaji.bandi]

Look at the below guide may help you:

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/firepower_threat_defense_site_to_site_vpns.html

[Rob Ingram · Accepted solution]

@Spyros Kasapis 

I assume you are referring to having an FTD at the central location, with 2 internet connections (Primary/Secondary)?

I've not see any documentation for a full mesh with backup interfaces scenario. I've tested on FTD 6.5, the problem is when defining a VPN topology you can only specify 1 interface, not both. In this scenario, cisco would usually recommend a router at the hub.

You cannot create 1 Mesh Topology, but you can get creative and define multiple VPN topologies to achieve the same thing.

1 x Hub/Spoke topology - HQ-FTD (Primary ISP interface) > Extranet (spoke ip)

1 x Hub/Spoke topology - HQ-FTD (Secondary ISP interface) > Extranet (spoke ip)

1 x Hub/Spoke topology - Spoke (the FMC managed object) > Extranet Hub (define multiple peer IP address)

1 x Mesh topology for all spokes

Use IP SLA on the hub to failover to the secondary ISP if the primary fails. Use DPD on the spokes to detect the Primary ISP failure.

HTH

[Spyros Kasapis]

Thank you all for your quick response ,

Belaji i red this link .

Rob  i  am testing these scenarios , 

we have a full mesh vpn topology with 10 ftd's all in HA , in our central location the internet connection is stable the problem is in the remote sites if the primary internet connection fails the backup is a vdsl line .