VPN redundancy single IP 2 ASA's

[fgasimzade]

Hello all,

Is it possible to configure active\standby for a site-to-site VPN using 2 Cisco ASA 5510 or 5520 with a single ISP

I remember I read somewhere that this was not possible, but can not find any information now

Thank you

[Francesco Molino]

Hi

If you have a active/failover ASA and you setup the outside interface with only 1 IP, that means actually you have the following config:

interface gi0/1

  nameif outside

  security-level 0

  ip address x.x.x.x x.x.x.x ==> without the standby keyword.

The failover will work and the standby ASA will get the actual IP of the active ASA. However, the limitation is that you can't monitor this interface to trigger a failover on the standby. That means if you have a link failure on the outside there won't be an automatic failover.

Thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question.