Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Backup remote peer

I need to configure my ASA to get a second IP-peer to be as a backup for the VPN IPSec tunnel if the primary fails.

Any one can help?

Thank you.

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Backup remote peer

Set a second peer in the crypto map:

"Configuring multiple peers is equivalent to providing a fallback list. For each tunnel, the security appliance attempts to negotiate with the first peer in the list. If that peer does not respond, the security appliance works its way down the list until either a peer responds or there are no more peers in the list."

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/c5.html#wp2193237

If the tunnel is already active and then the first headend fails, it will take a few minutes for the DPDs (dead peer detect) to sense the tunnel is down, but after this the failover should happen automatically; when the primary tunnel negotiations fails, it should go to the backup peer configured.

-heather

1 REPLY
Cisco Employee

Re: Backup remote peer

Set a second peer in the crypto map:

"Configuring multiple peers is equivalent to providing a fallback list. For each tunnel, the security appliance attempts to negotiate with the first peer in the list. If that peer does not respond, the security appliance works its way down the list until either a peer responds or there are no more peers in the list."

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/c5.html#wp2193237

If the tunnel is already active and then the first headend fails, it will take a few minutes for the DPDs (dead peer detect) to sense the tunnel is down, but after this the failover should happen automatically; when the primary tunnel negotiations fails, it should go to the backup peer configured.

-heather

213
Views
0
Helpful
1
Replies