cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
405
Views
0
Helpful
2
Replies
Highlighted
Beginner

ASA Easy VPN failover issue

Hi guys,

In our company, we got two 5510 and some 5505 firewalls.

now, I want to use EASY VPN. All of 5505 will be used by sites and branch offices. Two 5510 are our two headend.

I setup 5505 connect with two 5510 by easy VPN. one 5510 is primary server, another one is secondary. Now, once the primary server down, 5505 can switch to secondary 5510 automatically.

However, if the primary back to online. 5505 can not switch back to primary server automatically.

Is anyone know that how to fix it?

Thanks a lot

2 REPLIES 2
Highlighted
Cisco Employee

You will need to manually clear the tunnel for it to switch back over to the first ASA. The tunnel will not automatically failback over to the first ASA unless the second ASA also goes down.

-heather

Highlighted

Thanks, right now, I did some testing.

The only way can do that is:

I setup the maximum connect time = 2 mins. in IPsec GroupPolicy at secondary 5510.

Which means every two mins, all EASY VPN has to re-connection to secondary server.

Then, once the primary server up, all 5505 will connect to 5510 primary within 2 mins.

Is it a way? I am worry about that, during primary 5510 outage, the secondary firewall will got a lot of VPN re-connection.

Content for Community-Ad