Use both the ISP Links in ASA

[raghu.jrs]

HI

we have ASA 5510 on which

Outside interface ip 1.1.1.0/29

Backup interface ip 2.2.2.0/29

inside subnet 192.168.1.0/22

i want use the outside interface only for my IPsec connection (to Connect to remote office for accessing he internal hosted services) & the default route should be with backup interface( route backup 0.0.0.0 0.0.0.0 2.2.2.2),

if i put a natting for the remote office subnet will it work, can any one kindly help me with the configuration, 

remote office subnet's

10.10.1.0/24 -> public/peer Ip 3.3.3.0/29

10.10.2.0/22 -> Public/peer ip 4.4.4.0/29

[rvarelac]

Hi raghu.jrs ,

If you only will use the outside interface for the VPN IPSEC , you need to apply the crypto map on that interface and add some route for the VPN traffic.

Example:

crypto map mymap peer  10.10.10.10

crypto map mymap interface outside

And the routing would be:

route outside 10.10.10.10 255.255.255.255 x.x.x.x

route backup 0.0.0.0 0.0.0.0 2.2.2.2

where x.x.x.x = next hop outside int

All the other traffic will be routed to the backup interface , only the VPN traffic go out on the outside interface.

Please rate helpful posts !

Hope it helps

- Randy -

[raghu.jrs]

i had put a routes as below  & configured the crypto map

route outside 3.3.3.3 255.255.255.255 1.1.1.2
route outside 4.4.4.4 255.255.255.255 1.1.1.2
route inside 192.168.1.0 255.255.252.0 172.30.1.1

route backup 0.0.0.0 0.0.0.0 2.2.2.2

where

3.3.3.3 & 4.4.4.4 -> is the public Ip of remote office's(peer ip)

1.1.1.2 -> is the next hop outside int

2.2.2.2 -> is the next hop backup int

10.10.1.0/24 & 10.10.2.0/24 -> is the private subnet of the remote office's

with this configuration the IPsec is not working (not establishing the tunnel), i'm not able to reach the remote office,

if i change the default route point to the outside interface everything is working fine,

can you please help me what could be the issue.

[rvarelac]

Hi

Can you run a packet-tracer  to check the route the VPN traffic takes. 

- Randy - 

[Marius Gunnerud]

did you try clearing the VPN sessions?

clear crypto ikev1 isakmp

clear crypto ipsec sa

Do you have any NAT statements that are redirecting the local hosts out the backup interface?

--

Please remember to select a correct answer and rate helpful posts