2821 dual isp active/active with vpn

tiago.nunes · ‎01-06-2009

I'll be deploying this solution:

1 ASA that terminates VPN from a few remote sites

1 2821 with two ADSL Annex M (SDSL) WIC's

When both Internet Accesses are working, i want to send all vpn traffic through one of them, and the internet traffic to the other...however, if one of the ISP fails, all traffic should be forwarded through the same WIC.

How can I do this?

The remote sites will have 877 routers. In these routers, all i have to do is to configure 2 VPN peers, right?

The central site as well as almost all the remote sites have fixed ip addresses, and the ones that don't have it, will use dyndns

Thank You

rasoftware · ‎01-06-2009

Tiago,

I have done something similar in the past. If I am correct in understanding the ASA will sit behind the 2821 with two WICs?

I did this with a PIX and 1800 but should be the same.

1) Sit the ASA behind the router and give it a private address and a private address to the inside of the router.

2) Configure your router with both WAN links. I used route-maps and policy based routing to get around the NAT issues and provide a way of switching traffic should the main link down.

3) I also created route-map to direct web traffic out of the unused backup interface during normal operation.

4) Use and IP SLA dynamically determine if the main router is up.

5) You will need to set multi peers on the 800 - there is however no way I know to create a preference that I know of.

The biggest pain was getting the IPSEC to fail over behind the NAT. Again I used another route-map to get this working.

It might be simpler to use the router to create the tunnels - this avoids all the NAT issues and problems with IPSEC over the translation.

tiago.nunes · ‎01-06-2009

Thank you for your answer....however, i think i didn't got everything...

let's see:

1 - ok

2 - i didn't got this one

3 - i didn't understood this one too

4 - i never used this feature, where do i activate it?

Can you post the configurations you made, so i can have an example?

Best regards