Cisco ASA VPN S2S Failover

[mikiNet]

Hello Guys,

I writing to you becuase I met very strange problem. But first I describe my topology and my goal.

I have two ASA in different localization. Fisrt ASA1 has one WAN link to ISP, second ASA2 has two WAN link to ISP1 and ISP2 (for redundancy purpose)

Topology:

                                                           ------------  1 ISP

ASA1 --------- Site-to-Site ---------                                    ASA2

                                                           ------------  2 ISP

Between ASAs I have VPN Site-to-Site and everythink working good. In First ASA1 I have configured crypto map with two public addresses of ASA2 for redundancy:

crypto map outside-map 20 set peer 1.1.1.1 2.2.2.2

But problem appear with this scenario:

ASA2 loss connectivity to primary ISP (1.1.1.1), so it switch to backup ISP(2.2.2.2) SLA monitor trigger this action.  ASA1 detect changes and initialize VPN connectivity to second public IP of ASA2 --- 2.2.2.2. And still everythink working good, failover works.

Problem appear when ISP1 comes back on ASA2, because ASA1 has still VPN connectivity with ASA2 via backup ISP(2.2.2.2) and ASA2 now sending packet via primary link(1.1.1.1) but VPN session between ASAs is established on ISP2.... 

How to trigger Teardown VPN session on old link and set up new connection via primary link ? I want an automated solution, not manual, because when I manually clear crypto isakmp all return to good state. 

[Rob Ingram]

@mikiNet so ISP1 is now active again and the default route has changed back to ISP1 but the tunnel is still terminated on ISP2 interface? Perhaps create an EEM script to detect when ISP1 is active again to then automatically clear the SA terminated on ISP2 interface.

[mikiNet]

Exactly! ISP1 is now active again and the default route has changed back to ISP1 but the tunnel is still terminated on ISP2 interface

[mikiNet · Accepted solution]

This is solution for my case: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118087-technote-asa-00.html