Configuring multiple peer IPs for Site-to-Site VPN on a Firewall Context

[Hassan Mwangi]

I am running a Cisco 5585 ASA Firewall version 9.1. I am running the context mode to cater for my different cloud customers. I have a new customer who needs a Site-to-Site VPN to a remote location. The remote location have three peers IPs configured in fail-over mode which i need to configure on my end.

Please advise if in this is possible and how to go about the configuration.

[Marius Gunnerud]

You could set up the ASA with a dynamic crypto map.  That way the ASA will accept VPN connections from dynamically assigned IPs on the remote host, so long as all other parameters match up the vpn will be established.

Have a look at this link for the configuration:

https://www.fir3net.com/Firewalls/Cisco/how-to-configure-a-cisco-asa-site-to-site-vpn-between-a-static-and-dynamic-ip-based-peers.html

--

Please remember to select a correct answer and rate helpful posts

[Hassan Mwangi]

Hi Marius,

This is possible and have done it in a router or an ASA without the context. You are able to create the different crypto maps for each of the failover peers.

But how about in a context firewall? Anyone who has done it and has worked?

[Marius Gunnerud · Accepted solution]

A context is just like any stand-alone firewall, just virtualized. I have done it and it worked fine for me.

--

Please remember to select a correct answer and rate helpful posts

[Hassan Mwangi]

The above is correct. The firewall context is the same as the non-context firewall and below is a sample congifuration that worked for me.

# set peer XXX.XXX.XXX.145 XXX.XXX.XXX.156 XXX.XXX.XXX.29

# tunnel-group XXX.XXX.XXX.145 type ipsec-l2l

# tunnel-group XXX.XXX.XXX.145 ipsec-attributes

(config-tunnel-ipsec)# pre-shared-key ***********

# tunnel-group XXX.XXX.XXX.156 type ipsec-l2l

# tunnel-group XXX.XXX.XXX.156 ipsec-attributes

(config-tunnel-ipsec)# pre-shared-key ***********

# tunnel-group XXX.XXX.XXX.29 type ipsec-l2l

# tunnel-group XXX.XXX.XXX.29 ipsec-attributes

(config-tunnel-ipsec)# pre-shared-key **********

[Walter Astori]

I think that you must specify multiple peers with the command :

crypto map 15 outiside_map 15 set peer XXX.XXX.XXX.XXX YYY.YYY.YYY.YYY ZZZ.ZZZ.ZZZ.ZZZ

[Marius Gunnerud · Accepted solution]

You could do that, but then you would need a crypto map for each peer matching also the crypto ACL and transform set.  With a dynamic vpn you only need to configure it once.

But of course if you enter all 3 manually you have more controll of what VPNs you have set up...just more work.

--

Please remember to select a correct answer and rate helpful posts