S2S VPN multiple peers for FTD 2110 using FMC

[Keith Miller]

Hello all,

We purchased the new Firepower 2110s and I'm working on converting the configs on our ASA 5510s running on 9.0(4) to the FTD platform.

Something I've noticed for one of our use-cases is that I can not specify multiple (2) peers for a specific tunnel like I could with the traditial ASAs. For example, we use Zscaler (cloud-based proxy service) and part of being in compliance with their SLA is to have 2 peers configured in case the primary goes down. It looked something like this:

crypto map outside_map 10 set peer Peer_address_1 Peer_address_2

Is there a solution for this that anyone knows of?

Regards,
Keith

[Aditya Ganjoo]

Hi,

Cisco has an internal enhancement request to implement redundant peer for ikev1.

Right now, there is no option to configure redundant peer or multiple peers for same crypto map on FTD.

6.3 release may address this issue.

Regards,

Aditya

Please rate helpful and mark correct answers

[Keith Miller]

Thanks Aditya, I appreciate the swift reply.

So it's not a given that 6.2.2 or 6.3 will support this? I have a feeling I'll be running into situations like this regularly with these new appliances. And to think, I considered our configuration to be pretty standard. </facepalm>

Is there any way I can follow this internal request or do I just have to hope, wait, and stalk the release notes as new versions of FTD are released?

Thanks,

Keith

[ropauljr]

Checking back in on this. Does FTD now have something in place for:

crypto map outside_map 10 set peer Peer_address_1 Peer_address_2

[dhgoel]

Refer this Bug for more info: CSCvg43238.It is fixed in 6.2.3

[ropauljr]

Thanks @dhgoel !!!

[nihalsalim]

Add Primary IP followed by comma separated optional backup peer IP addresses.

This option is available from version 6.2.3 and above.

[Flavio Costa]

Feature implemented on FTD release 6.6: "You can now add a backup peer to a site-to-site VPN connection, for IKEv1 and IKEv2 point-to-point extranet and hub-and-spoke topologies. Previously, you could only configure backup peers for IKEv1 point-to-point topologies." Important to mention that this is available by FMC managed devices only.

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/relnotes/firepower-release-notes-660/features.html