Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Configuring multiple peer IPs for Site-to-Site VPN on a Firewall Context

I am running a Cisco 5585 ASA Firewall version 9.1. I am running the context mode to cater for my different cloud customers. I have a new customer who needs a Site-to-Site VPN to a remote location. The remote location have three peers IPs configured in fail-over mode which i need to configure on my end.

Please advise if in this is possible and how to go about the configuration.

Everyone's tags (1)
2 ACCEPTED SOLUTIONS

Accepted Solutions

You could do that, but then

You could do that, but then you would need a crypto map for each peer matching also the crypto ACL and transform set.  With a dynamic vpn you only need to configure it once.

But of course if you enter all 3 manually you have more controll of what VPNs you have set up...just more work.

--

Please remember to select a correct answer and rate helpful posts

--

Please remember to rate and select a correct answer

A context is just like any

A context is just like any stand-alone firewall, just virtualized. I have done it and it worked fine for me.

--

Please remember to select a correct answer and rate helpful posts

--

Please remember to rate and select a correct answer
6 REPLIES

You could set up the ASA with

You could set up the ASA with a dynamic crypto map.  That way the ASA will accept VPN connections from dynamically assigned IPs on the remote host, so long as all other parameters match up the vpn will be established.

Have a look at this link for the configuration:

https://www.fir3net.com/Firewalls/Cisco/how-to-configure-a-cisco-asa-site-to-site-vpn-between-a-static-and-dynamic-ip-based-peers.html

--

Please remember to select a correct answer and rate helpful posts

--

Please remember to rate and select a correct answer
Community Member

Hi Marius,This is possible

Hi Marius,

This is possible and have done it in a router or an ASA without the context. You are able to create the different crypto maps for each of the failover peers.

But how about in a context firewall? Anyone who has done it and has worked?

A context is just like any

A context is just like any stand-alone firewall, just virtualized. I have done it and it worked fine for me.

--

Please remember to select a correct answer and rate helpful posts

--

Please remember to rate and select a correct answer
Community Member

# set peer XXX.XXX.XXX.145

The above is correct. The firewall context is the same as the non-context firewall and below is a sample congifuration that worked for me.

# set peer XXX.XXX.XXX.145 XXX.XXX.XXX.156 XXX.XXX.XXX.29

# tunnel-group XXX.XXX.XXX.145 type ipsec-l2l

# tunnel-group XXX.XXX.XXX.145 ipsec-attributes

(config-tunnel-ipsec)# pre-shared-key ***********

# tunnel-group XXX.XXX.XXX.156 type ipsec-l2l

# tunnel-group XXX.XXX.XXX.156 ipsec-attributes

(config-tunnel-ipsec)# pre-shared-key ***********

# tunnel-group XXX.XXX.XXX.29 type ipsec-l2l

# tunnel-group XXX.XXX.XXX.29 ipsec-attributes

(config-tunnel-ipsec)# pre-shared-key **********

Community Member

I think that you must specify

I think that you must specify multiple peers with the command :

crypto map 15 outiside_map 15 set peer XXX.XXX.XXX.XXX YYY.YYY.YYY.YYY ZZZ.ZZZ.ZZZ.ZZZ

You could do that, but then

You could do that, but then you would need a crypto map for each peer matching also the crypto ACL and transform set.  With a dynamic vpn you only need to configure it once.

But of course if you enter all 3 manually you have more controll of what VPNs you have set up...just more work.

--

Please remember to select a correct answer and rate helpful posts

--

Please remember to rate and select a correct answer
998
Views
0
Helpful
6
Replies
CreatePlease to create content