Hello!
I have an issue where we have redundant links into our ISP using BGP at different sites and about a dozen remote sites connected via L2L VPN tunnels. I have found a couple of issues when trying to do VPN redundancy (the headend VPN endpoints are the outside interfaces of our ASA(s)).
1) If you configure a backup peer, it does not automatically fail back to the primary (per the cisco.com docs). does anyone know that when the ISAKMP needs renegotiated does this happen?
2) Using RRI is not possible since for a L2L tunnel it does RRI no matter if the tunnel is up or down. Is there a way to conditionally advertise the remote subnets into the network from the ASAs based on weather or not the tunnel is up on a specific ASA?
3) I was looking at running OSPF over the tunnels instead and just increasing the cost on the local ASA interface of the backup site if that's the only way this will work. Then just having two static L2L tunnels up, one to the primary site and one to the secondary site. possible?
We eventually plan to move to DMVPN which would fix this issue altogether, but in the meantime - any advice? thanks for any assistance!
B
