L2L VPN migration question

[erikpavelchak]

We have a few sites that all VPN to one ASA, that ASA is getting a new IP address, can i configure and new crypto map with a high sequence number with the same interesting traffic?

Will the ASA try that one if it cannot reach the old IP?

[Marcin Latosiewicz · Accepted solution]

In crypto map VPN you must not introduce overlap, but you can add multiple peers to same crypto map entry. Or use a dynamic entry without  any peer IP.

[erikpavelchak]

Ah ok, with multiple peers does it try the next one if the first isnt available? how does it sequence?

I would need a tunnel-group for the new IP also correct?

[Vishnu Sharma · Accepted solution]

Yes a tunnel group is needed with same pre-shared-key. apart from this, in crypto map, you can define it like this:

crypto map <crypto_name> <seq> set peer <ip1> <ip2>

Vishnu

[erikpavelchak]

And this will try the second IP if first one is unavailable?