Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Issue with VPN Failover in ASA Firewall

Hi,

We use ASA firewall at many of our offices to provide S-S IPSEC VPN connectivity to our customers.Typically we need to establish S-S vpn to two different sites at customer end, one being primary and other being backup.Both tunnels need to have the same VPN parameters including encryption domain.Offcourse, the only difference between the tunnels will be peer ip.We build VPN config just by adding the backup peer ip in the same crypto map.The failover doesnt work automatically. Even if the primary tunnel goes down, the backup tunnel doesnt get established and traffic dont pass through it.The firewall has only static route for peer ip's. Please suggest if there is a better way to handle VPN failover for the above requirement.

Thanks in advance.

Sample Config:

crypto map ciscovpn 1 match address ciscoacl

crypto map ciscovpn 1 set peer 1.1.1.1 <<PRIMARY PEER>>

crypto map ciscovpn 1 set peer 2.2.2.2 <<BACKUP PEER>>

crypto map ciscovpn 1 set transform-set ciscocts

crypto map ciscovpn 1 set security-association lifetime seconds 28800

crypto map ciscovpn 1 set security-association lifetime kilobytes 4608000

crypto map ciscovpn interface inside

Regards,

Rajesh

1 REPLY
New Member

Re: Issue with VPN Failover in ASA Firewall

Check these steps to narrow down the failover problems:

Check the network cables connected to the interface in the waiting/failed state and, if it is possible, replace them.

If there is a switch connected between the two units, verify that the networks connected to the interface in the waiting/failed state function correctly.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml#Monitor

Check the switch port connected to the interface in the waiting/failed state and, if it is possible, use the another FE port on the switch..

Check that you have enabled port fast and disabled both trunking and channeling on the switch ports that are connected to the interface.

221
Views
5
Helpful
1
Replies