Active/Active ASA remote VPN access limitations.

[Mahmoud Nossair]

Hi Experts

We have an Active/Active ASA 5520 setup, as i know in Active/Active setup there is no remote VPN access, So i could overcome this limitations?

I have a solution but i dont know if it is ablecable or not? we have a spare ASA 5510, so i can use it behind Active/Active Firewalls and assign a public static NAT IP address to it and open all IPSEC and VPN ports and let the remote users to connect to it, is this ablecable setup or not? please advise.

Thanks in advance

[Christopher Bell]

Sure, I think you could do that.  NAT will be a little tricky on post 8.2 code however.  The other option I can think of (we did this one time) is if you have enough static IPs with your ISP provider you could use a second interface off your edge router.  Put a static pointing to your 5510, then just connect the 5510 back to your core.  VPN connections would bypass the 5520 pair and terminate on the 5510.  In my opinion, that would be an easier setup and avoid tricky NAT configs.  It would probably also prove to be a little 'faster' for your remote users.