Two same tunnels up

[kostasthedelegate]

Hello I have an ASA 5512 with 9.12(4)18

I want to establish S2S with AWS. 

I have two public for the tunnels and the traffic is the same. 

The requirement from AWS is that both tunnels are up. 

I have configured using virtual interfaces, but only one is up.

I have used this link: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/200982-ASA-IPsec-VTI-connection-Amazon-Web-Serv.html

Any ideas?

Thanks and regards, 

Konstantinos

[Rob Ingram]

@kostasthedelegate 

---

@kostasthedelegate wrote:

I have two public for the tunnels and the traffic is the same. 

---

You have two public what? Are you referring to two public IP addresses on the ASA?

On the ASA VPN traffic is terminated on the IP address assigned to a physical interface, do you have two outside interfaces?

The example you provided sourced traffic from the same source interface, but to two different destination IP addresses.

Provide your ASA configuration and the output of "show crypto ipsec sa"

[kostasthedelegate]

Hello @Rob Ingram 

My bad!
The two public IP are on the destination

I have one public IP on my end

[Rob Ingram]

Ok, please provide the configuration and the output of "show crypto ipsec sa" and "show route"

[kostasthedelegate]

Hello, 

I have attached the output of the crypto

[Rob Ingram]

Is that all of it? I don't see the 2 tunnel-groups?

Output of "show crypto ipsec sa"???

[kostasthedelegate]

It is in the attached crypto.txt

The tunnel is configured in the interfaces tunnel1 and tunnel2

[Rob Ingram · Accepted solution]

The output of "show crypto ipsec sa" isn't for either of the AWS peer addresses, as per the link you attached.

I'm referring to tunnel-groups for each of the AWS peer IP addresses (as defined in the AWS link above), you need to add these.

tunnel-group 52.34.205.227 type ipsec-l2l
tunnel-group 52.34.205.227 ipsec-attributes
 ikev1 pre-shared-key xxxxxx
 isakmp keepalive threshold 10 retry 10
tunnel-group 52.37.194.219 type ipsec-l2l
tunnel-group 52.37.194.219 ipsec-attributes
 ikev1 pre-shared-key xxxxxx
 isakmp keepalive threshold 10 retry 10

[kostasthedelegate]

@Rob Ingram 

You saved me

I thought I had fixed it but possibly I had not saved it. 

It works now. I fixed the routing and both are up

Thank you for the support

Regards, 

Konstantinos