Configuring multiple peer IPs for Site-to-Site VPN on a Firewall Context

Answered Question
Sep 16th, 2014
User Badges:

I am running a Cisco 5585 ASA Firewall version 9.1. I am running the context mode to cater for my different cloud customers. I have a new customer who needs a Site-to-Site VPN to a remote location. The remote location have three peers IPs configured in fail-over mode which i need to configure on my end.

Please advise if in this is possible and how to go about the configuration.

Correct Answer by Marius Gunnerud about 2 years 11 months ago

A context is just like any stand-alone firewall, just virtualized. I have done it and it worked fine for me.

--

Please remember to select a correct answer and rate helpful posts

Correct Answer by Marius Gunnerud about 2 years 11 months ago

You could do that, but then you would need a crypto map for each peer matching also the crypto ACL and transform set.  With a dynamic vpn you only need to configure it once.

But of course if you enter all 3 manually you have more controll of what VPNs you have set up...just more work.

--

Please remember to select a correct answer and rate helpful posts

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
Marius Gunnerud Wed, 09/17/2014 - 02:27
User Badges:
  • Red, 2250 points or more
  • Cisco Designated VIP,

    2017 Firewalling

You could set up the ASA with a dynamic crypto map.  That way the ASA will accept VPN connections from dynamically assigned IPs on the remote host, so long as all other parameters match up the vpn will be established.

Have a look at this link for the configuration:

https://www.fir3net.com/Firewalls/Cisco/how-to-configure-a-cisco-asa-site-to-site-vpn-between-a-static-and-dynamic-ip-based-peers.html

--

Please remember to select a correct answer and rate helpful posts

Hassan Mwangi Wed, 09/17/2014 - 03:13
User Badges:

Hi Marius,

This is possible and have done it in a router or an ASA without the context. You are able to create the different crypto maps for each of the failover peers.

But how about in a context firewall? Anyone who has done it and has worked?

Correct Answer
Marius Gunnerud Wed, 09/17/2014 - 03:17
User Badges:
  • Red, 2250 points or more
  • Cisco Designated VIP,

    2017 Firewalling

A context is just like any stand-alone firewall, just virtualized. I have done it and it worked fine for me.

--

Please remember to select a correct answer and rate helpful posts

Hassan Mwangi Thu, 11/27/2014 - 01:28
User Badges:

The above is correct. The firewall context is the same as the non-context firewall and below is a sample congifuration that worked for me.

# set peer XXX.XXX.XXX.145 XXX.XXX.XXX.156 XXX.XXX.XXX.29

# tunnel-group XXX.XXX.XXX.145 type ipsec-l2l

# tunnel-group XXX.XXX.XXX.145 ipsec-attributes

(config-tunnel-ipsec)# pre-shared-key ***********

# tunnel-group XXX.XXX.XXX.156 type ipsec-l2l

# tunnel-group XXX.XXX.XXX.156 ipsec-attributes

(config-tunnel-ipsec)# pre-shared-key ***********

# tunnel-group XXX.XXX.XXX.29 type ipsec-l2l

# tunnel-group XXX.XXX.XXX.29 ipsec-attributes

(config-tunnel-ipsec)# pre-shared-key **********

Walter Astori Wed, 09/17/2014 - 02:45
User Badges:

I think that you must specify multiple peers with the command :

crypto map 15 outiside_map 15 set peer XXX.XXX.XXX.XXX YYY.YYY.YYY.YYY ZZZ.ZZZ.ZZZ.ZZZ

Correct Answer
Marius Gunnerud Wed, 09/17/2014 - 03:04
User Badges:
  • Red, 2250 points or more
  • Cisco Designated VIP,

    2017 Firewalling

You could do that, but then you would need a crypto map for each peer matching also the crypto ACL and transform set.  With a dynamic vpn you only need to configure it once.

But of course if you enter all 3 manually you have more controll of what VPNs you have set up...just more work.

--

Please remember to select a correct answer and rate helpful posts

Actions

This Discussion

Related Content