ā01-12-2017 11:27 AM
We have a Cisco ASA 5585 HA pair in context mode (Version 9.1(7)4 <context>) being used for VPN tunnels.
We have a customer who wants a primary (Their main site)and backup (their secondary site) VPN tunnel to peer with our ASA. Both tunnels will peer to us with the same IP Address, using the same crypto ACL (subnets the same on both ends for both tunnels). In the Cisco world this used to be a problem, and would cause conflicting SAs .Is this still a problem, or can I use Twice NAT and NAT the destination subnets on the secondary crypto map and have both tunnels up at the same time?
ā01-13-2017 06:47 AM
This should not be a problem as your default route (primary) will determine which peer ip address becomes active.
ā01-13-2017 07:05 AM
Secondary crypto map wont help here as the crypto ACL is the same, it will always match the first crypto map entry. Also since the peer is the same ip address, the ASA wont even try to establish 2 tunnels as it already has an existing phase 1 to the peer. Twice NAT can help if your peer ip address was different.
I am trying to understand the purpose of using the same ip address on the peer side. If they were 2 separate peer ip addresses, you could use the backup peer option on a crypto map (set peer x.x.x.x y.y.y.y) to achieve failover to the other peer. Also, keeping both tunnels at the same time for then same traffic also does not make sense as it would only go through one tunnel at a time.
ā01-13-2017 08:00 AM
Perhaps it was not clear when I mentioned "same IP Address"
they have two sites, we have one:
My Site (3.3.3.3)<---> Their Site 1 (1.1.1.1)
My Site (3.3.3.3)<---> Their Site 2 (2.2.2.2)
So, you are saying that if we had the same destination subnets in both crypto ACLs, if the primary tunnel goes down, then traffic would not pass through the second tunnel?
ā01-13-2017 08:12 AM
Makes more sense now. Yes, the ASA will not send traffic to second tunnel if the first one is down, if they are configured in 2 different crypto map entries and the source and destination networks in the crypto ACL are the same. The ASA matches crypto map sequentially and it is nto dependent whether tunnel is up or down, so it will always match first tunnel.
The better option is to use the backup peer and the same crypto map entry as I mentioned before. This way, the ASA tries to reach the primary peer 3 times and if it fails, it will establish a tunnel to the secondary IP.
ā01-13-2017 08:33 AM
I used to read about secondary peers having trouble with conflicting SAs.
Is this not a problem?
ā07-17-2024 12:22 PM
Hi Rahul,
How can I configure the backup peer tunnel? Please explain.
ā07-20-2024 12:08 PM
Make new port it better
MHM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide