cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2060
Views
0
Helpful
6
Replies

Dual IPSEC VPN tunnel on single remote peer

brianbono
Level 1
Level 1

is it possible to establish two IPSEC VPN tunnels to a single remote peer?

I currently have two ISP connections and i wanted to make two tunnels for failover but im not sure if there is an issue on the tunnel groups since i would end up having only on tunnel group for both the tunnel.

6 Replies 6

mattiaseriksson
Level 3
Level 3

How is your internet redundancy configured? Are you using PIX,ASA,IOS or what?

Im currently using an ASA that is configured with a static route tracking feature.

attached is a network topology for reference.

thanks

If you have PIX/ASA/VPNC on both ends you can use the backup Lan-to-Lan feature.

The end that will connect to multiple ip-addresses should be configured as originate-only with the set connection-type command, and use the crypto map set peer command to order the priority of the peers.

The other end should be configured with the answer-only keyword.

The originate-only end attempts to negotiate with the first peer in the list. If that peer does not respond, the ASA works its way down the list until either a peer responds or there are no more peers in the list.

I have a cisco asa on my end but on the remote end is a multitech firewall.

how do i go about this?

In that case I am not sure. But if the other end permits multiple peer statements you can try to just configure your end as answer-only, or do nothing and see what happens. It mostly depends on how the multitech handles redundancy, the ASA side only has one address to connect to.

A router on each side eould provide much better redundancy by running DMVPN.

Review Cisco Networking products for a $25 gift card