Hello!
I have implemented dual ISP routing on ASA firewall and faced a problem with a VPN tunnel.
- Pre-implementation state:
The firewall had one outgoing interface ("outside"). Several VPN tunnels were built over it. The most part of Internet traffic was also routed over one of the tunnels (to ZScaler to implement additional policies there. ZScaler works as a responder only). The default route was also tired to this interface
- Target design:
The additional interface was added ("outside3"). It has to be used as the primary one for all Internet destinations and the tunnel to ZScaler. All other existed tunnels, incoming traffic, and AnyConnect clients have to be kept on "outside" interface
I modified static routes, added necessary tracking, created a separate crypto map for new interface, updated NAT rules. At the first view, everything works fine, but a bit later the client started complaining about Internet connection quality.
I saw such messages in the logs related to ZScaler remote peer:
Jul 31 18:24:53 [IKEv1]IP = 165.225.214.48, Attempting to establish a phase2 tunnel on outside interface but phase1 tunnel is on outside3 interface. Tearing down old phase1 tunnel due to a potential routing change.
Jul 31 18:24:53 [IKEv1]IP = 165.225.214.48, IKE Initiator: New Phase 1, Intf inside, IKE Peer 165.225.214.48 local Proxy Address 10.0.0.0, remote Proxy Address 0.0.0.0, Crypto map (outside_map0)
...
Jul 31 18:24:53 [IKEv1]Group = 165.225.214.48, IP = 165.225.214.48, Session is being torn down. Reason: Unknown
Troubleshooting together with ZScaler didn't help much. As I wrote their equipment works as a responder only and they see in their logs packets coming from both ASA interfaces.
The situation becomes stable when I disable "outside3" interface and all traffic is routed over "outside" interface again.
I attached running-config and two debugs files, one was collected when only one interface was active and other was collected when both outside interfaces were UP.
Please share your ideas what could be wrong
