You need an affordable solution to connect multiple locations with dynamic IPs to a central VPN server.
FlexVPN/DMVPN would solve this but central IOS routers cost plenty of money and offer only a limited HA solution. You would need a HSEC license if you want to go for over 85Mbit and 225 tunnels. Also firewall management via CLI is a mess.
If you have dynamic IPs (e.g. with 4G) and don't want to go for certificates, you have to use PSK. The downside is that every PSK has to be the same via DefaultL2LGroup. To avoid this, we create IKEv2 tunnel groups and set the isakmp ID on the clients to the name of the tunnel group.
The ASA (esp. 5515-X) is quite affordable, handling multiple tunnels with high throughput. Also it offers really good HA with Active/Standby failover including stateful IPSEC failover. On the downside it doesn't support FlexVPN, so the config part on the routers is quite big.
On the client side we use 880 Branch Routers which support all needed features.
On the ASA we configure the following (only crypto parts)
Specify the subnets:
access-list outside_cryptomap extended permit ip object OUR-NET object CLIENT-NET
Hi All, I have a question during my project for ASA High AvailabilityHere's the topology : The Failover already working, but one point was not working .So if we remove cable from ISP 1 (orange cable / A), the traffic didn't go through ISP 2.&nbs...
I am keen to watch some of the ISE Webinar Recordings but I can't seem to access them. I am registered and logged in, but I cannot figure out whether I am locked out, or whether these sessions were not recorded - it's contradictory.
Hi I'm thinking a ise deployment and I want use a "2-node deployment (redundant)" with a "node A" and "node B", and use a "node C" as standalone node for syslog or loggin. Can use this deployment? Regards.
Duplicate header name; X-Agari-Policy-Matched: Compromised_SendersX-Agari-Policy-Matched: Untrusted MessagesX-Agari-Trust-Score: 1.0 I have a content filter that writes the header to the log; Condition: No conditionAction: log-entry("C...