VTI IPsec fails between two FTD

[sherali mamatkarimov]

I have two remote FTD managed by FMC and I have two ISPs in each side and I created 4 IPSec connections in each side to failover them by BGP, they work fine until one of ISP goes down and IPSec gets down, but after ISP gets up IPSec not get up, it stays down for a long time in troubleshoot menu there are error Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel. Map Tag= __vti-crypto-map-Tunnel1-0-1. Map Sequence Number = 65280,

IPSec gets up after random long time, I tried to log in CLI and type clear crypto ipsec sa peer <ip address> but it is useless, can you help me?

[MHM Cisco World]

Four IPSec ?

That I think wrong 

You need only two IPSec' 

One for each ISP if it failed then failover to other ISP IPsec.

MHM

[sherali mamatkarimov]

Site A ISP A - Site B ISP A 

Site A ISP A - Site B ISP B

Site A ISP B - Site B ISP A 

Site A ISP B - Site B ISP B 

[MHM Cisco World]

no need these two tunnels 

Site A ISP A - Site B ISP B

Site A ISP B - Site B ISP A 

https://community.cisco.com/t5/security-knowledge-base/failover-site-to-site-ipsec-vti-tunnels-between-two-asa-9-7-1/ta-p/3166653

MHM

[sherali mamatkarimov]

Ok anyway problem is not in creating second VPN as backup or other VTI, problem is in not going up VPN after ISP gets down up

[MHM Cisco World]

Sorry I was some busy last days 

from cisco doc.

""You can deploy the backup tunnel in the following scenarios:

• Both peers having service provider redundancy backup. In this case, there are two physical interfaces, acting as the tunnel sources for the two VTIs of the peers.

• Only one of the peers having service provider redundancy backup. In this case, there is an interface backup on only one side of the peer and on the other end, there is only one tunnel source interface.""

check below for VPN topology from FMC
node A and node B both have backup VTI config it for the second ISP
config default route with IP SLA toward primary ISP
config defualt route with different distance for the secondary ISP

MHM

[marce1000]

      - FYI : https://community.cisco.com/t5/network-security/ipsec-tunnel-between-cisco-ftd-and-umbrella-sig/m-p/4692083#M1093575

 M.

[sherali mamatkarimov]

Didn't find any information about my case

[tvotna]

@sherali mamatkarimov, 4 tunnels won't work due to CSCvo13642. This is a well-known limitation. Simplify your configuration to 2 tunnels as suggested by @MHM Cisco World and re-test collecting relevant "show" outputs when both tunnels are up and running, then when ISP1 goes down and then when it goes up again. This should include routing tables, IKEv2 and IPSec states, interface states, etc. If the tunnel over ISP1 doesn't come up, collect IKEv2 and IPSec debugs.

[sherali mamatkarimov]

I left only 2 tunnels but status of one of them is unknown, in routing table I can't see directly connected VTI interface