cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

ASA Redundancy with a difference

russjstewart
Beginner
Beginner

Hi There,

We are starting to explore the world of VPN using Cisco ASA to connect remote sites to our Primary Data Centre (PDC) with some success I would like to add.

My issue now is  that we now need to add some redundancy, by installing an ASA at our Secondary Data Centre (SDC) with some level of automated failover.

The PDC and SDC are at physically separate locations with different ISPs and different class C IP addresses. We are not worried about ISP or link failure at the remote VPN site, as it will only affect a single site. We are only worried about an ISP  or ASA failure at the PDC

My idea is to set up a new connection profile on each remote ASA pointing to the SDC ASA, as well as the existing profile connecting  to the PDC ASA, my queries are

1. Is this a really bad way of doing it

2. Is there any way of prioritising which connection profile to use, both connection profiles would have the same remote end IP addresses.

Almost all the documentation I can find relate to ISP redundancy or active/standby failover between ASA at one site

Sorry for my ignorance,

Thanks for any help you may be able to give

1 ACCEPTED SOLUTION

Accepted Solutions

Hi,

on the remote ASA you should configure this;

crypto map vpn set peer 1.1.1.1. 2.2.2.2 

The remote ASA will try 1.1.1.1 if no response it will try 2.2.2.2 

The ASA can't have two tunnels up at the same time that are using the same acl entries. That if have an encryption from network A to network B. There can be no two tunnels active at the same time for those two networks,.

You need to setup routing inside the data center so that the traffic will come to the active ASA only and the tunnel will be brought up. When the active ASA fails the traffic should start flowing the second ASA and the tunnel will come up at that ASA.

Mo,

View solution in original post

5 REPLIES 5

Mohammad Alhyari
Cisco Employee
Cisco Employee

You can configure one primary server and a back server to that one. This seems to be the best Choice if you wanna achieve failover. Please have a look here:

<ServerList>
        <HostEntry>
            <HostName>Mobile access</HostName>
            <HostAddress>PRIMARY IP/FQDN</HostAddress>
            <BackupServerList>
                <HostAddress>SECONDARY IP/FQDN</HostAddress>
            </BackupServerList>
            <MobileHostEntryInfo>
                <NetworkRoaming>true</NetworkRoaming>
                <CertificatePolicy>Auto</CertificatePolicy>
                <ConnectOnDemand>false</ConnectOnDemand>
                <ActivateOnImport>false</ActivateOnImport>
            </MobileHostEntryInfo>
        </HostEntry>
    </ServerList>

https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/administration/guide/b_AnyConnect_Administrator_Guide_4-0/anyconnect-profile-editor.html#ID-1430-0000026c

Moh,

Hi Moh,

Thanks for taking the time to respond to this, but I think I did not supply enough information. we are trying to introduce redundancy in site to site VPN, so if the PDC goes down the ASA appliance at  the remote site will then use the ASA at the SDC to connect. It doesn't matter if the remote ASA has 2 tunnels up, it is a question around how it decides which tunnel to use.

My limited understanding of Cisco Anyconnect is that it is a mobility product geared towards laptops etc.

Please correct me if I am wrong.

Thanks Again

Hi,

on the remote ASA you should configure this;

crypto map vpn set peer 1.1.1.1. 2.2.2.2 

The remote ASA will try 1.1.1.1 if no response it will try 2.2.2.2 

The ASA can't have two tunnels up at the same time that are using the same acl entries. That if have an encryption from network A to network B. There can be no two tunnels active at the same time for those two networks,.

You need to setup routing inside the data center so that the traffic will come to the active ASA only and the tunnel will be brought up. When the active ASA fails the traffic should start flowing the second ASA and the tunnel will come up at that ASA.

Mo,