VPN, ASA to two different peers, same subnets on both VPN tunnels

[wilson_1234_2]

We have a Cisco ASA 5585 HA pair in context mode (Version 9.1(7)4 <context>) being used for VPN tunnels.

We have a customer who wants a primary (Their main site)and backup (their secondary site) VPN tunnel to peer with our ASA. Both tunnels will peer to us with the same IP Address, using the same crypto ACL (subnets the same on both ends for both tunnels). In the Cisco world this used to be a problem, and would cause conflicting SAs .Is this still a problem, or can I use Twice NAT and NAT the destination subnets on the secondary crypto map and have both tunnels up at the same time?

[oloyede29]

This should not be a problem as your default route (primary) will determine which peer ip address becomes active.

[Rahul Govindan]

Secondary crypto map wont help here as the crypto ACL is the same, it will always match the first crypto map entry. Also since the peer is the same ip address, the ASA wont even try to establish 2 tunnels as it already has an existing phase 1 to the peer. Twice NAT can help if your peer ip address was different.

I am trying to understand the purpose of using the same ip address on the peer side. If they were 2 separate peer ip addresses, you could use the backup peer option on a crypto map (set peer x.x.x.x y.y.y.y) to achieve failover to the other peer. Also, keeping both tunnels at the same time for then same traffic also does not make sense as it would only go through one tunnel at a time.

[wilson_1234_2]

Perhaps it was not clear when I mentioned "same IP Address"

they have two sites, we have one:

My Site (3.3.3.3)<---> Their Site 1 (1.1.1.1)

My Site (3.3.3.3)<---> Their Site 2 (2.2.2.2)

So, you are saying that if we had the same destination subnets in both crypto ACLs, if the primary tunnel goes down, then traffic would not pass through the second tunnel?

[Rahul Govindan]

Makes more sense now. Yes, the ASA will not send traffic to second tunnel if the first one is down, if they are configured in 2 different crypto map entries and the source and destination networks in the crypto ACL are the same. The ASA matches crypto map sequentially and it is nto dependent whether tunnel is up or down, so it will always match first tunnel.

The better option is to use the backup peer and the same crypto map entry as I mentioned before. This way, the ASA tries to reach the primary peer 3 times and if it fails, it will establish a tunnel to the secondary IP.

[wilson_1234_2]

I used to read about secondary peers having trouble with conflicting SAs.

Is this not a problem?