ASA Easy VPN failover issue

[edisonbbs]

Hi guys,

In our company, we got two 5510 and some 5505 firewalls.

now, I want to use EASY VPN. All of 5505 will be used by sites and branch offices. Two 5510 are our two headend.

I setup 5505 connect with two 5510 by easy VPN. one 5510 is primary server, another one is secondary. Now, once the primary server down, 5505 can switch to secondary 5510 automatically.

However, if the primary back to online. 5505 can not switch back to primary server automatically.

Is anyone know that how to fix it?

Thanks a lot

[hdashnau]

You will need to manually clear the tunnel for it to switch back over to the first ASA. The tunnel will not automatically failback over to the first ASA unless the second ASA also goes down.

-heather

[edisonbbs]

Thanks, right now, I did some testing.

The only way can do that is:

I setup the maximum connect time = 2 mins. in IPsec GroupPolicy at secondary 5510.

Which means every two mins, all EASY VPN has to re-connection to secondary server.

Then, once the primary server up, all 5505 will connect to 5510 primary within 2 mins.

Is it a way? I am worry about that, during primary 5510 outage, the secondary firewall will got a lot of VPN re-connection.