FTD ISP failover and DVTI

[Isaac Lama]

Hey Everyone, 
I have a new setup with FTDs and a CdFMC. CdFMC is on 7.4 and the firewalls are all on 7.3.1.

I'm trying to get ISP failover and VPN failover to work and it just doesn't seem to be working out. 

Right now I have a hub firewall in HA at a Datacenter that has one incoming ISP. I have a spoke with 2 ISPs. I have a DVTI Config on the hub with a primary and secondary VTI setup on the spoke. Traffic passes if I have a static route setup or if I enable "reverse route injection" enabled in the VPN Settings. I can't add a secondary route because the secondary route "cannot have the same destination gateway". This is the error I see. If the ISP Fails no traffic passes on the secondary tunnel. If I change the static route the traffic will pass. BGP is also not working for me as the neighbors never connect. 
Failover does seem to be working for ISP, however I cannot point an SLA outside of the network for a target. Pointing at the default gateway for the ISP is ok, but only if the device goes offline. Most of the time the problem is beyond the customer equipment so it's not accurate. 
Has anyone gotten this to work? 

[MHM Cisco World]

sorry friend one by one
you use hub and spoke in FW 
this FW have dual ISP 


are above is correct ?

MHM

[Isaac Lama]

Hi and thanks for the reply.  
Right now the Hub firewall is at our datacenter with the business critical systems behind it. It has one ISP. This firewall is in an HA pair. FPR1140 x 2 

I have a bunch of spokes but the setup is basically the same. An FPR1140 with 2 ISP at the main office spoke. And then FPR1010 at remote offices with 2 ISP. 

[MHM Cisco World]

I get better idea let me check it 

MHM

[MHM Cisco World]

thanks 

MHM

[Isaac Lama]

Hey MHM, and anyone else for that matter... is this some kind of crazy request? I have had so much trouble getting this to work and not to badmouth TAC but it seems like they don't know how to do this either (maybe it's just the technician I have). 

[MHM Cisco World]

It need some deep dive in topolgy' I will share my idea about solution.

Update you tonight 

MHM

[MHM Cisco World]

Hi Friend 
check below topolgy design, the idea in is in spoke not config two VTI one primary and other backup but config two VTI run in same time and make other level (IGP or BGP) do control the traffic 
the Hub have two path to Internal Spoke via two VTI and prefer one will most prefer 

Sorry for late reply

Thanks 

MHM

[Isaac Lama]

Sorry For my late reply and thanks for helping me with this. It does look like it will work, let me test this out on one of my spokes and I will accept as a solution. Thanks again!