VPN as backup of direct link connection

[sistemaspcsnet]

Hello,

We have a direct connection between to sites running ASA in both of them, we want to setup a VPN as backup of direct link, are there any trick to do it?

Now we are routing traffict between sites by one interface and static routes, we don´t know how to setup right metrics to VPN as backup.

Thanks.

[Federico Coto Fajardo · Accepted solution]

Hi,

If using a separate interface for the backup VPN tunnel and using static routes, you can use IP SLA on the ASAs to track the primary interface and use it while it's up.

The IP SLA will track and use the backup interface (triggering the backup tunnel) when something goes wrong on the primary link.

Just as in Cisco IOS, the IP SLA is tied to a track object which in turns look at the static routes.

The priority is handled by setting the AD manually on the static routes.

As well, when the primary links recover, it will be used again (since it's preferred).

Hope it helps.

Federico.