Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Dual ISP with IPSecVPN

Hi Experts,

I've been doing some research on how to configure an ASA with Dual ISP with IPSec Tunnel going to HQ.

Scenario_ASA.JPG

Here is the outline that I think I need I may need to do.

1.  Configure the Redundant Link, which led me to this:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

Fair enough, I was able to grasps the concept on the above link.

2. Configure VPN with HQ_ASA. This seems to be the tough part.

What I would like to do is that Primary Link (15 Mbps DSL) will form VPN Peer with HQ when it is UP (used tracking as stated above).

When the Primary Link fails Secondary Link (5 Mbps DSL) will form a New VPN Peer with HQ

On both instances, the HQ_VPN Peer will have the same IP Address.

Looking forward for your response guys.

Thank you.

Everyone's tags (4)
2 ACCEPTED SOLUTIONS

Accepted Solutions

Dual ISP with IPSecVPN

Hello Jemel,

Yes, I understand what you mean but no I have not seen any documents related to this but I could help if required.

Again on site A just configure the normal stuff ( 2 interfaces, the SLA stuff, create 2 crypto maps and apply one in the primary interface and the other one on the secondary)

On site B just create 2 crypto maps ( One will set the peer to be the ASA1 Primary link, The second one will be the ASA1 Secondary link) Isakmp will try to communicate to both interfaces but as only one is active only one tunnel will be generated

Let me know if I was clear enough, if not do not worry just let me know and I will be more than glad to help you

Regards,

Julio

Rate all the helpful posts

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
New Member

Dual ISP with IPSecVPN

Hi Jemel,

I have similar setup in real world. Below is the config

in HQ

1) Under main crypto map , just add seconday IP of Branch WAN2

crypto map Outside_map 1 set peer x.x.x.x y.y.y.y

x.x.x.x = Branch Primary WAN IP
y.y.y.y = Branch Secondary WAN IP

2) Create a Tunnel-group for backup peer

tunnel-group y.y.y.y type ipsec-l2l
tunnel-group y.y.y.y ipsec-attributes
 pre-shared-key try123
in Branch

1) Just apply crypto map to backup interface.

crypto map Outside_map interface backup_wan





Regards, Nagis
28 REPLIES

Dual ISP with IPSecVPN

Hello Jemel,

You will need to configure to crypto maps on the other site as you cannot use the same Ip address because each interface as you know its on it's own broadcast domain.

So

On site A configure SLA, and 2 crypto maps one on each interface

On site B configure 2 crypto map one for interface A ( the active ) and one for interface B ( The secondary )

Regards,

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
New Member

Dual ISP with IPSecVPN

Thanks Julio.

This seems to be feasible. Do you happen to know other documentation for implementing such?

I've been actually working on 5510s just a little over 4 months and man, this is intense!

Regards,

Jemel

Dual ISP with IPSecVPN

Hello Jemel,

Yes, I understand what you mean but no I have not seen any documents related to this but I could help if required.

Again on site A just configure the normal stuff ( 2 interfaces, the SLA stuff, create 2 crypto maps and apply one in the primary interface and the other one on the secondary)

On site B just create 2 crypto maps ( One will set the peer to be the ASA1 Primary link, The second one will be the ASA1 Secondary link) Isakmp will try to communicate to both interfaces but as only one is active only one tunnel will be generated

Let me know if I was clear enough, if not do not worry just let me know and I will be more than glad to help you

Regards,

Julio

Rate all the helpful posts

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
New Member

Dual ISP with IPSecVPN

Thanks Julio.

This has been very helpful. I am on the right track with this.

Regards,

Jemel

New Member

Dual ISP with IPSecVPN

Hi Julio,

I haven't implemented this yet, doing a little testing using gns3.

It came to me, what will happen the NAT configurations I have?

It seems that the protected networks, (siteA inside network and siteB inside network) will likely be OK.

What about the other traffic like internet traffic? How will it be NATed?

Thank you.

Regards,

Jemel

Dual ISP with IPSecVPN

Hello,

On site A you will need to create nat for the primary and the secondary link, just in case the primary goes down.

So you will be natted to the primary as soon as it's up

Regards,

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
New Member

Dual ISP with IPSecVPN

Santiago,

According to your diagram HQ only has one link to the internet is this correct?

If so then you should only need one crypto map applied to the outside interface and specify two peers on the crypto map statement, peer 1 15 mbps ISP, peer 2 5 mbps ISP.

Julio, please correct me if I’m wrong or if we can configure two crypto maps to the same interface.

Thanks,

Juan

Dual ISP with IPSecVPN

Hello Juan Ruiz,

You can only have one crypto map on each interface but each of the crypto map can have more than one entry ( so you will set 2 peers,etc)

Regards,

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
New Member

Dual ISP with IPSecVPN

Hi Julio,

That's understood, so there will be 2 NAT entries, one for each interface whichever is active.

Hi Juan,

Yes, I came across the same scenario. It also mentioned just having to create 1 crypto map with 2 peers in it.

https://supportforums.cisco.com/thread/2060152

I'm planning to implement this though and the other as suggested by Julio.

Thanks.

Dual ISP with IPSecVPN

Hello

Correct Santiago

Remember to rate all the helpful posts

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
New Member

Dual ISP with IPSecVPN

I've actually tried and implemented the project but there seem to be an issue.

There was nothing that was configured on the:

Configuration > Device Setup > Routing > Static Routes

But, when I checked on the device, and tried show route there's seem to be an entry in the routing table:

ciscoasa# sh route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

       * - candidate default, U - per-user static route, o - ODR

       P - periodic downloaded static route

Gateway of last resort is x.x.x.x to network 0.0.0.0

C    a.a.a.a 255.255.255.0 is directly connected, inside

C    x.x.x.x 255.255.255.248 is directly connected, outside

d*   0.0.0.0 0.0.0.0 [1/0] via x.x.x.x, outside

ciscoasa#

May I know why is it that the new interface that I added which is PPPoE is not listed as CONNECTED?

And also, what caused the default route to be d*?

Hoping to here from you soon.

Thank you.

Dual ISP with IPSecVPN

Hello Jemel,

If the interface is up, you should see the network directly connected.

RIght now looks like the ASA does not have the interface properly configured. if you do a sh interface ip brief what is the status of the interface?

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

Dual ISP with IPSecVPN

Hello Jemel,

Are you using the protocol IKEV2 or is that your intention?

I mean looks like you are using IKEv1, I think you are referring to phase 2 (Ipsec).

The problem you are having now it's because of the configuration between both sides.

Please do the following

-Check the Diffie-Hellman group on each side

-Check that both sides has a pre-shared key configured ( On router B you need to have 2, one for each peer)

Regards,

Julio

Remember to rate all the helpful posts

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
New Member

Dual ISP with IPSecVPN

Hi Julio,

I've checked on the DH, and both sides are on Group 2.

I will check on the pre-shared key if both sides are correct.

Thanks.

Dual ISP with IPSecVPN

Hello Jemel,

Sure.. Keep me posted

do a more system:running-config | begin tunnel-group

in order to check them on clear text.

Regards,

Julio

Rate all the helpful posts

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
New Member

Dual ISP with IPSecVPN

Hi Julio,

VPN Connectivity is already UP, but there might be something wrong with my access-list. I still can't browse the internet.

I've read some of your replies to similar issues and I've taken note of it.

https://supportforums.cisco.com/thread/2123926

ciscoasa(config)# packet-tracer input inside Tcp 10.80.1.1 1025 4.2.2.2 80

Phase: 1

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in   0.0.0.0         0.0.0.0         outside

Phase: 2

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Result:

input-interface: inside

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

ciscoasa(config)#

Funny thing is, I've already configured my access-list to almost allow all. There must be something that I missed.

New Member

Dual ISP with IPSecVPN

Hi Jemel,

I have similar setup in real world. Below is the config

in HQ

1) Under main crypto map , just add seconday IP of Branch WAN2

crypto map Outside_map 1 set peer x.x.x.x y.y.y.y

x.x.x.x = Branch Primary WAN IP
y.y.y.y = Branch Secondary WAN IP

2) Create a Tunnel-group for backup peer

tunnel-group y.y.y.y type ipsec-l2l
tunnel-group y.y.y.y ipsec-attributes
 pre-shared-key try123
in Branch

1) Just apply crypto map to backup interface.

crypto map Outside_map interface backup_wan





Regards, Nagis
New Member

Dual ISP with IPSecVPN

Hello Waren,

Thanks! Will give this a try tomorrow.

I'm currently using 8.4 ASA so there might be a little difference.

With HQ, do I need to configure the Group Policy?

Should it also have the same Group Policy as the primary Peer?

New Member

Dual ISP with IPSecVPN

Hi Jemel,

By right, there is no need to configure Group Policy, Just adding the Tunnel-group / backup peer ip will do. It will work for 8.2/8.3/8.4

Regards, Nagis
New Member

Dual ISP with IPSecVPN

Thanks Waren.

Hope the vpn tunnel will work after this configuration changes.

Will update you if it does.

Thank you.

Regards,

Jemel

New Member

Dual ISP with IPSecVPN

Hi Waren,

Your instructions were correct! I was able to configure the VPN Tunnel to HQ as desired. Thank you.

I still have a little problem though, I can't connect  to the internet. I can ping the DNS Server 4.2.2.2 with no problem.

But I cant browse the internet. I've already changed the "Configuration > Firewall > NAT Rules" refelcting the new interface that I have but no internet access still.

Is there still something that I need to do?

Thank you and hoping to hear from you soon.

Regards,

Jemel

New Member

Dual ISP with IPSecVPN

Can u post your config file?

Regards, Nagis
New Member

Dual ISP with IPSecVPN

Hi Waren,

This is ok now, found a discussion here in the community and it solved the issue for me.

I can now browse the internet. It was a DNS issue.

Thank you for your help, much appreciated!

Regards,

Jemel

New Member

Dual ISP with IPSecVPN

welcome.

Regards, Nagis
New Member

Dual ISP with IPSecVPN

Hi Warren,

How are you? Hope all is well.

I was wondering since we have almost the same set-up, may I know what are the other things that you have implemented with this setup. Did you do improvements to make the user experience better? QoS for the VPN traffic perhaps? Do you have QoS implemented? By which, L2L traffic to and from branch office to head office will be given priority?

Hope to hear from you soon.

Thanks.

New Member

Dual ISP with IPSecVPN

Hi Jemel,

I have dedicated Internet link for VPN connectivity, so no need of QOS. But I have implimented third party vendor to setup Link Load Balancing for VPN traffic. You can take a look at www.elfiq.com. This will ensure all available WAN link is utilized , intead of siting Idle and still been payed.

Regards,

Nagis

Regards, Nagis
New Member

Dual ISP with IPSecVPN

Thanks for the prompt reply Warren. Will look into this product if this is feasible for our needs.

Much appreciated.

New Member

Dual ISP with IPSecVPN

Hi Guys,

I've always thought that I've configrued correctly my ASA. Thing is, yesterday we had a failure on our primary DSL Link, was thinking that the secondary link would kick-in but waited for probably 10-15 minutes there was no internet connectivity still. What's strange is that I had VPN connection to HQ. What I did was on the CLI I checked on what route (show route) the ASA is using, - it was still the failed Primary. I cleared the route on the Primary link (clear route outside_p) then I got the result that I wanted. Internet and VPN is UP and running.

Is there something that I'm missing, I was wondering it could be because of my Base License, maybe I should get the Security PLus License for my desired setup?

2037
Views
3
Helpful
28
Replies
CreatePlease login to create content