Active/passive VPN issues on router

[Joebananas]

Hello everyone,

I am labbing a theoretical situation (and maybe a solution for something) and cannot get it to work, if anyone can provide feedback please do (This includes if this is dumb idea or a better way to handle an active/passive tunnel to the same peer IP on a router)

Topology is:

Router has 2 WAN links. I have a crypto map applied to primary VPN interface. I have a track that is pinging the ISP peer on the primary VPN interface. If this goes down (forcefully shut) then an EEM script will remove the crypto map from that main VPN interface and move it to the secondary interface.

This router is peered to an ASA.

The ASA has a crypto map with 2 peers. It is IKEv2.

The tunnel works just fine on the main VPN interface on the router. Once I force shut the main interface (simulate a failure), my EEM script kicks off, and the crypto map gets removed from the main VPN interface and applied to the second interface but this tunnel never comes back up. If I manually reverse the order of the peers on the ASA (From set peer IP1 IP2 to set peer IP2 IP1) then the tunnel on the second VPN interface on the router comes up.

Can anyone offer any help here? Attached is a pic of topology and configs of ASA and router.

Please help this is driving me nuts.

[Rob Ingram]

Hi@Joebananas I don't see why you need to remove the crypto map from the outside interface. On the router, just use IP SLA and track the first ISP connection if that fails change the default route to route traffic via the 2nd ISP connection. You can use an EEM script for preemption if you wish, example.

I'd personally change the VPN to a route based VPN and use VTIs.

On the router I'd configure FlexVPN. You can then either configure 2 tunnels (each with a different source) and use the routing protocol to prefer one tunnel over the other. Or use the FlexClient configuration.

Examples: https://www.cisco.com/c/en/us/support/security/flexvpn/products-configuration-examples-list.html

Both the router and the ASA are reliant on DPD keepalives to clear the tunnels if the connection is dropped

[Joebananas]

Hello Rob, thanks for responding.

So I just changed my configuration to have a static default route to ISP 1 (Primary) and a default route to ISP2 (back up) with an ad of 2 with crypto map applied to both interfaces.

I shut down the main ISP1 interface and the back up default route was installed to ISP2 but the tunnel just does not want to come up. I end up seeing no ikev2 SAs for the new/backup tunnel (goes from IN-NEG to being deleted) but I do have IPSec SA with incrementing errors on the back up ISP, and the old IPSEC sa associated with primary interface just stays up not doing anything.

If I could, I too would also turn this into a route-based VPN but it is not possible at the moment.

[Rob Ingram]

---

@Joebananas wrote:

but I do have IPSec SA with incrementing errors on the back up ISP, and the old IPSEC sa associated with primary interface just stays up not doing anything.

---

If you still have the old IPSec SA then Dead Peer Detection keepalives is not configured on the router, this will clear down the old SAs. Dead Peer Detection (DPD) is disabled by default. 

DPD can be configured under the IKEV2 profile or globally

crypto ikev2 profile profile-name
 dpd interval retry-interval {on-demand | periodic }

or

crypto ikev2 dpd interval retry-interval {on-demand | periodic }

[Joebananas]

Hello Rob,

I just was testing to see why that IPSEC SA was there still. It seems that even if the interface is shut down, as long as the crypto map is applied to the interface, that IPSEC SA populates with no ikev2 SA. Not sure if this is expected behavior or oddities due to being virtualized hardware.

[MHM Cisco World]

two Peer ONE have one interface other have two interface, 
solution is 
1- config crypto map set with multi Peer IP 
2- config crypto map set using the LO

[Joebananas]

Hello MHM,

What do you mean by LO?

I do have multiple peers configured on the ASA crypto map. The one that is second in the peer line never wants to work. If I flip the order as mentioned above, it comes up just fine.
crypto map set peer PEER1 PEER2

Peer1 is ISP1 which is the main VPN interface on the router. Once that interface is shut down, and the crypto map is applied to the PEER2 interface it never comes up. If I switch the ASA crypto map to crypto map set peer PEER2 PEER1 then it comes up but I cannot fail back over to primary interface because the same issue occurs here.

[MHM Cisco World]

Yes I see I already run lab from Yesterday and hope figure out why it not work. 
I will update you soon 

[Joebananas]

Thank you for taking the time. Driving me crazy! Please do update me if you find a solution

[Joebananas]

So far I have tried:

Creating a second crypto map to apply to the back up interface thinking maybe it was an issue with the same map applied to different interfaces. Did not work. Same issue. If I reverse the order on the ASA of the peers so the first Peer is the secondary on the router, it comes up.

Tried creating a second entry in the ASA crypto map (splitting up peer 1 and peer 2 to different crypto map entries) and this did not work. I had main Peer as entry 1 and Peer 2 as entry 2 both using the same components including ACL and it did not come up during failover. I removed the match address entry from entry 1 and Peer 2 finally came up. I thought since both crypto map entries had different peer IPs that it would not land on entry 1 in crypto map but it seems it looks at ACL first because removing that allowed the tunnel to come up due to what I imagine as finding no match in entry 1 (since ACL was removed) and went to entry 2 which is the back up IP.

Still can not get this to work.

Ideally I would like to use the same crypto map on the router for both interfaces and let the default route deal with which IP the ASA peers to.

I would like to have one crypto map entry with 2 set peer entries on the ASA side.

Please anyone, chime in!!! please

[MHM Cisco World]

it work only there are some thing you must to detect issue 
I run lab and it failed  I use 
debug cyrpto isakmp 
debug crypto ipsec 
and detect issue 
in ISAKMP phase1 the DH group is mismatch 
in phase2 the ASA use ESP-SHA and router not use it and hence the traffic is drop 
so use above debug to detect issue 
if you want share it here I will help you

[Joebananas]

Hello mhm!

how is that possible?

in my lab phase 1 and 2 settings are identical. I don’t have to change anything except the order of the peers on the ASA. The fact that it comes up when I do that, would imply that Dh group, phase 2, etc should be fine no?

[MHM Cisco World]

Oh, you meaning that it work when the you change the Peer order ?
if Yes can you share the show ip route in router ?

ping from Router to ASA using the interface IP that is not work.

[Joebananas]

The route that the router takes is a default route. I’ve got one default route to isp1 (main vpn interface) being tracked by a track that pings the isp1 peer, and another to isp2 with an ad of 2. The second kicks in once I simulate a failover by shutting down the primary interface. The Asa is just using one default route out to the router connected to it and that router learns the peer ips through bgp. When peer 1 goes down, it is not pingable by Asa (which tears down the tunnel due to dpd) but peer 2 is pingable but the tunnel never comes up. I actually tested this on production equipment (asa ver 9.14) and it was the same behavior. The only difference between my lab and production is we tested the production environment with peer ips on two different devices but the behavior was the same regardless

[MHM Cisco World]

in router we can not change the default route 
BUT 
we can config static route for ASA LAN toward ISP1 using track, track here is direct to ASA IP 
and config static route for ASA LAN toward ISP2 using high metric 

here if track to asa is UP then router will use ISP1 toward ASA, if down then it will use ISP2

try this if the track not work I will check EEM in router detect ISAKMP keepalive and shift traffic toward ISP2