Multiple vpns on Firepower firewalls

[User_80617]

Hi,

Hope you are doing well.

Is it possible to create 2 different vpns on same ftd? say for example vpn1.xyz.com and vpn2.xyz.com. Each of the vpn will use its own dedicated outside interface on ftd like outside_vpn1 and outside_vpn2 and these interfaces will be backup to each other?

[MHM Cisco World]

Let me double check

[Rob Ingram]

@User_80617 yes you can. You'd need to use SLA monitor and track the connection via the first interface, in order to change the default route via the second link.

[User_80617]

Hi,

Thanks for reply. Before we move to failover part, is it possible to run each vpn urls on its repective interface. Like, vpn1.xyz.com is running on interface outside_vpn1 and vpn2.xyz.com on outside_vpn2? Is this works? Because what would be default route then OR no default route needed, the vpn interface will auto use the same interface from which the request has received? 

[Rob Ingram]

@User_80617 the FTD is not that intelligent to know to route the traffic back the same interface the request came in on.

For testing, configure the VPNs, define the default route via the primary connection (outside_vpn1), then create a specific static route to a test public IP address via the secondary connection (outside_vpn2). Traffic from that test public IP address would connect to outside_vpn2 VPN and be routed back out that same interface. Use Reverse Route Injection (RRI) to dynamically advertise the remote networks, so the ASA know where to route the remote networks. All other traffic would connect to outside_vpn1 and routed back via the default route. You can then at least test both VPNs before testing the failover part.

[MHM Cisco World]

Local LAN1 -FPR- Remote LAN1
Local LAN2 -FPR-Remote LAN2

you need multi static route 
two default route for any traffic that not match ACL of VPN, using IP SLA and high metric you can select which one is primary and secondary 

two static route for Local LAN1 to Remote LAN1 via both OUT interface (use also IP SLA and metric)
two static route for far VPN end IP (use also IP SLA and metric)

two static route for Local LAN2 to Remote LAN2 both OUT interface (use also IP SLA and metric)
two static route for far VPN end IP (use also IP SLA and metric)

check this solution