VPN tunnel from ASA to 2 sites both having same destination private subnet i.e 172.16.1.0/24

[Nitesh_A]

Hello Experts,

Just want to know is it possible to establish tunnel from MAINOFFICE ASA(in diagram) to SITE1 ASA & SITE2 router. I know both wont be established at same time.

But what if MAINOFFICE ASA tunnel has been established with SITE1 and traffic is flowing fine.

Once i remove the peer by "no crypto map CMAP 10 set peer 2.2.2.3". 

So is it possible for the traffic to flow to SITE2 router because there is only one peer now i.e

"crypto map CMAP 20 set peer 3.3.3.3". I have attached my topology diagram where i was trying to accomplish the same but couldn't succeed.

Below snap has debug logs from SITE2 router.

Thankyou

[Karsten Iwen]

Yes, it should work. I would do it a little different:

Scenario1:

Configure two EEM applets: One to remove the complete config for site 1 and adds the config for site two. And one with the oposite.

Scenario2:

Or even better, configure two route-based VPNs to both peers. These VPNs have no knowledge ot the connected networks and can be established at the same time. You only need a static route pointing to one or the other tunnel.

[MHM Cisco World · Accepted solution]

crypto map anyname set peer IP1 IP2 

since both IP1 & IP2 serve the same subnet.

[Karsten Iwen]

---

@MHM Cisco World wrote:

crypto map anyname set peer IP1 IP2 

since both IP1 & IP2 serve the same subnet.

---

they serve the same subnet but not the same network. Putting both IPs in the same crypto-map sequence will not work here.

[Nitesh_A]

@MHM Cisco World Yes this worked.

Why it didn't work when i define crypto map CMAP 10 set peer 2.2.2.2 & crypto map CMAP 20 set peer3.3.3.3 in two seperate line?

@Karsten Iwen I dont know about route based vpn , i will read it and will try to accomplish by that way as well.

If you have a link where i can read, please share. Thankyou so much for the help

Thankyou