two tunnels with the same crypto acl

[r.spiandorello]

Hi, a cloud service provider requests to setup two ipsec tunnels with the same crypto access-list, to reach the same network in cloud.

Now I'd like to know waht's the behaviour of ASA with two "similar" crypto map on the same interface and if ASA requests a stateful path or not.

thank you in advance

greatings

renato

[Karsten Iwen]

In this scenario you normally don't use two crypto-map sequences. You just have one sequence with two "set peer" statements. With that you have the redundency to reach the target also if one if the peers fail.


Sent from Cisco Technical Support iPad App

[r.spiandorello]

yes sure, that was my solution but the cloud services provider requested two tunnels. Can I have problems ?

Sent from Cisco Technical Support iPhone App

[ju_mobile]

You can define in the cryptomap that it matches the same traffic groups but the peer will be the definitive variation as highlighted. It cannot be the same peer address so from a cli

crypto_map OUTSIDE_MAP1 match address OUTSIDE_CRYPTOMAP
crypto_map OUTSIDE_MAP1 set peer 1.1.1.1
<>
crypto_map OUTSIDE_MAP2 match address OUTSIDE_CRYPTOMAP
crypto_map OUTSIDE_MAP2 set peer 2.2.2.2

Regards

Ju


Sent from Cisco Technical Support iPad App

[r.spiandorello]

Ju, that's what I've done, but I'd like to know if ASA apply stateful logic to the two tunnel, in other words if a session packet goes through the first channel, can I have a session packet through the second channel ?

thanks

renato

[ju_mobile]

Hi Renato,

Apologies, I understand what your saying is two tunnels up and running to the same service provider but with two peer addresses. You want to start a session on one tunnel and also send data from the same session down the secondary tunnel, whilst maintining session state.

I guess what your question also needs to raise is how the asymmetrical routing would work with the applications.

would be a great one to lab so sorry not sure enough to offer an answer..