Issue with VPN Failover in ASA Firewall

Unanswered Question

Hi,

We use ASA firewall at many of our offices to provide S-S IPSEC VPN connectivity to our customers.Typically we need to establish S-S vpn to two different sites at customer end, one being primary and other being backup.Both tunnels need to have the same VPN parameters including encryption domain.Offcourse, the only difference between the tunnels will be peer ip.We build VPN config just by adding the backup peer ip in the same crypto map.The failover doesnt work automatically. Even if the primary tunnel goes down, the backup tunnel doesnt get established and traffic dont pass through it.The firewall has only static route for peer ip's. Please suggest if there is a better way to handle VPN failover for the above requirement.

Thanks in advance.

Sample Config:

crypto map ciscovpn 1 match address ciscoacl

crypto map ciscovpn 1 set peer 1.1.1.1 <<PRIMARY PEER>>

crypto map ciscovpn 1 set peer 2.2.2.2 <<BACKUP PEER>>

crypto map ciscovpn 1 set transform-set ciscocts

crypto map ciscovpn 1 set security-association lifetime seconds 28800

crypto map ciscovpn 1 set security-association lifetime kilobytes 4608000

crypto map ciscovpn interface inside

Regards,

Rajesh

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
bwalchez Tue, 04/14/2009 - 14:00

Check these steps to narrow down the failover problems:

Check the network cables connected to the interface in the waiting/failed state and, if it is possible, replace them.

If there is a switch connected between the two units, verify that the networks connected to the interface in the waiting/failed state function correctly.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml#Monitor

Check the switch port connected to the interface in the waiting/failed state and, if it is possible, use the another FE port on the switch..

Check that you have enabled port fast and disabled both trunking and channeling on the switch ports that are connected to the interface.

Actions

This Discussion