Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
4996
Views
10
Helpful
6
Replies

VPN setup for dual ISP ASA

tato386
Level 6
Level 6

‎03-21-2018 06:33 PM - edited ‎03-12-2019 05:07 AM

I have an ASA setup with failover from ISP-A to ISP-B and I currently have an IPSec VPN using a static IP connection profile using ISP-A and its corresponding interface.  I would like to be able to establish this same tunnel over ISP-B and its corresponding outbound interface but the connection profile name is the same (due to static IP) and ASDM does not allow duplicate names.

 

I tried using names for the connection profiles but when I did the VPN would not establish and I saw errors in the log referencing something like "cannot find matching tunnel" or something similar.

 

What can I do in this situation?

Thanks,
Diego

2 people had this problem
Labels:
0 Helpful
6 Replies 6

Marvin Rhoads
Hall of Fame
Hall of Fame

‎03-21-2018 08:23 PM

Just bind the crypto map to both your outside interfaces. There's no need to create separate crypto maps.

 

Something like this:

 

crypto map outside_map 1 match address <ACL for interesting traffic>
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer <peer address>
crypto map outside_map 1 set ikev1 transform-set <desired transform-set>
crypto map outside_map interface <nameif of first ISP interface>
crypto map outside_map interface <nameif of second ISP interface>

 

tato386
Level 6
Level 6
In response to Marvin Rhoads

‎03-22-2018 08:10 AM

Its great to have a CLI.

 

Thanks!

0 Helpful

burtonj996
Level 1
Level 1
In response to Marvin Rhoads

‎09-13-2018 11:58 AM

Does this support IKEV2?

0 Helpful

Roy Harrington
Cisco Employee
Cisco Employee
In response to burtonj996

‎09-13-2018 03:00 PM

Yes this is supported on Ikev2 as well for asa.

0 Helpful

mpisano
Level 1
Level 1
In response to Marvin Rhoads

‎10-09-2019 05:21 AM - edited ‎10-09-2019 05:24 AM

I'm tired of deleting the crypto map and recreating it and adding a static route to the remote router on the alternate interface everytime a route fails so I thought I would try to multi-home the asa

I have tried to do what you explained in this thread and I have bound the crypto map to both interfaces. 

crypto map outside_map3 interface outside1
crypto map outside_map3 interface outside2

I removed all my 

route outside2 x.79.121.90 255.255.255.255  2.2.2.1 1
route outside2 x.152.20.146 255.255.255.255 2.2.2.1 1
route outside2 x.11.129.182 255.255.255.255 2.2.2.1 1
route outside x..83.7.127 255.255.255.255 2.2.2.1 1

But the remote sites will only connect to the primary isp

I presume that is because the two remaining 0.0.0.0 routes have matrix or 1 vs 3 or the lack of what direction to return traffic??

route outside 0.0.0.0 0.0.0.0 1.1.1.1 1
route outside 0.0.0.0 0.0.0.0 2.2.2.1 3

I see I can setup tracked routes, but I'm not concerned with a local ISP failure. Being an international company, I'm concerned about a route failure anywhere in the middle.  

The Remote sites (40) have 

crypto map outside_map3 1 set peer 1.1.1.2 2.2.2.2

On the HQ side I'll I simple want is both ISP's active and the ASA to answer on whichever interface the tunnel comes in on and use that interface to route the traffic back. I know it will be a bit random, I'm ok with that?

The crypto map's are double bound and the remote sites previously work on either interface previously when there were two maps. 

What am I missing? do I need a Dynamic-Map or VPN Route?

Any Suggestions appreciated

Regards,

Mike

0 Helpful
Customers Also Viewed These Support Documents