Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Failover pair, to failover pair - unable to access standby over VPN

Topology.

At the head end there is an ASA failover pair which forms a IPSEC VPN tunnel to a remote ASA failover pair. We manage the remote side by going through the VPN from the head end.

The problem is that I cannot access the standby ASA at the remote side because when my ssh or icmp traffic gets to it, it then thinks the return route is on its outside interface which doesn't have a tunnel to travel on and so it uses the public internet to try to get back which is dropped.

I can access the standby at the remote site going through the public internet, but not through the VPN tunnel.

The question is, how can I get management traffic (icmp,snmp,logging and ssh) to come back over the tunnel from the standby firewall at the remote site.

2 REPLIES
Silver

Re: Failover pair, to failover pair - unable to access standby o

Make sure that VPN failover is not supported on units running in multiple context mode. VPN failover available for Active/Standby failover configurations only.

Here is the URL for the ASA failover configuration guide. Follow the guide it may help you

http://www.cisco.com/en/US/docs/security/asa/asa81/config/guide/failover.html

New Member

Re: Failover pair, to failover pair - unable to access standby o

The firewalls aren't in multiple context mode. They are single contexts, active-standby. And the standby can't ping anything on the other side of the tunnel.

199
Views
0
Helpful
2
Replies