Site to Site VPN using 2 ASA's

[Oscar Martinez]

I just got this job a couple of weeks ago and they have older Cisco equipment they want me to work with right now before I let them know of my recommendations for upgrading. We have a WAN link from Cox in San Diego, CA. that provides the internet for our remote building across the border into Tijuana,MX through a wireless bridge using Cambium PTP 600 Series radios. We have an ASA 5510 on each side and everything is working as is albeit on a flat network. However we want to add a second WAN link using two seperate technologies. We would have a second Cox business link in San Diego but on the Tijuana side we want to add a 200 Mbps Fiber link. What is the best way to go about configuring the ASA's for it to work? Is a site to site VPN the way go to or is there a more practial and efficient way? What kind of overhead and speed decreases am I looking at? Please let me know if you need any additional information regarding the current network setup.

Any help would be greatly appreciated!

[Philip D'Ath]

Is the 200Mb/s fibre link in MX an Internet circuit?

So San Diego is going to have to WAN links, or are these actually two Internet links?

What is the speed of the WiFi link between the sites?

[Oscar Martinez]

Hi Philip thank you for the response. 

So to answer your questions: 

1. Yes,  the 200Mbps fiber link is an internet circuit

2. Yes, San Diego will have two internet links (one for VPN which would be main link and one for redundancy)

[Philip D'Ath]

This kind of solution is way easier with a Cisco Meraki MX which has built in support for dual Internet links.
https://meraki.cisco.com/products/appliances

Are you going to retain the WiFi link so both sides have the same layer 2 flat network, or are you intending on getting rid of it?

[Oscar Martinez]

I was thinking of using the second link as a redundant (failover) link. I don't intend it to be a flat network. I'm actually going to do the IP addressing scheme for VLANs soon as well as upgrading the switches since we currently have OLD 3500XL routers. Am going to get 3560's to replace them

[Philip D'Ath · Accepted solution]

Twice I have asked about the WiFi link and twice you didn't respond.  So I am going to assume it doesn't exist.

For the Mexico ASA you can configure the VPN to use a primary and backup peer IP address.  The primary being the main IP address on the San Diego link you want to use for VPN, and the backup being the second link.

On the San Diego ASA you would configure IP SLA and route tracking.  Use the route tracking to control static routes for the Mexico public IP address and Mexico private subnets.  You need to swing these across as a group when failing over between the ISP links.

[Oscar Martinez]

Sorry for the late reply got really busy at work. But I do very much appreciate the help and advice you have given me. Regarding the wifi link  you are correct, we will be getting rid of it. 

As for the Meraki MX solution it does look very attractive to what i'm trying to do and will further look into it. Thank you so much for your help! 

[Philip D'Ath]

No worries.  It would be great if you could rate responses that you think were helpful.

[Philip D'Ath]

Do all the Internet circuit's have a static IP?

[Oscar Martinez]

Yes, all of them have static IPs