site to site VPN peer ip address for failover

[vinodk_gupta]

Hi,

while creating site to site VPN/IPSec Tunnel on cisco ASA, can we put two peer ip address, one will be primary & other ip wiil be secondary when primary ip will not rechable.

[Karsten Iwen]

You are probably not talking about an ASA-FO-system? There you don't need to configure two peers as the ip address will move to the secondary ASA when the primary fails.

If the two peers are individual boxes, then you can specify two peers in the "set peer" statement of your crypto map. If you use Pre-Shared-Keys, then you also have to configure a second tunnel-group for the backup-peer.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni