Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

VPN Failover within the same ASA

Hi Everyone,

I'm working out a concept here and want to know if this can be done. On an ASA I would like to have 2 different interfaces connect to 2 different ISP's - one primary, one backup. As well I will be running VPN tunnels across the links.

What I want to know is if I have a tunnel established over ISP A to our remote site, and it fails, is there a way to have the state information and tunnel moved over to ISP B, on the same ASA device?

Thanks!

1 REPLY

Re: VPN Failover within the same ASA

First of all ASA does not support multiple default routes (out different interfaces), so you can't do an active-active ISP setup. It also does not support PBR.

AFAIK, you cannot achieve stateful VPN failover in this manner. You could set 'two' crypto map peer statements on the other side, but this will not give you stateful failover.

Cisco recommends IOS routers for L2L setups, as they are more feature rich in this regard.

Regards

Farrukh

145
Views
0
Helpful
1
Replies
CreatePlease login to create content