Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Management access to remote ASA standby VPN peer

I have a L2L VPN with a pair of 5515's running 9.1.1 in Active/Standby as the remote VPN peer.  I can get management traffic (ssh, snmp, radius, tacacs+, syslog) for the Active ASA to go through the VPN by using the "management-access inside" command, but I cannot get the Standby ASA to do the same.  My guess is that it receives traffic sent to it just fine but then sends traffic via its outside interface, since that's what the default route points to.  Since the Standby ASA doesn't have any active SA's, the traffic just goes out unencrypted and gets dropped.

Is there some trick to get the Standby ASA to send its management traffic via the inside interface so that the Active ASA picks it up and puts it on the VPN?



Everyone's tags (1)
Hall of Fame Super Silver

Re: Management access to remote ASA standby VPN peer

I use the Management interface for this function when I can. f I can't, I assign a standby IP to the secondary unit's inside interface and direct my management traffic that I explicitly want to go to the standby unit to that address. Your VPN clients should have private addresses that are located inside via a "route inside " command.

I seldom use it however, as one can see most of the occasional things needed from the standby from the active unit using the "failover exec standby ..." command.

New Member

Management access to remote ASA standby VPN peer

Thanks Marvin.  Please note that this is strictly a L2L VPN; there are no clients.  And unfortunately even "failover exec" commands don't work, because we TACACS+ command authorization and the ASA has to talk to the TACACS+ server over--you guessed it--the VPN.

I could try using the Management 0/0 interface, but I think it would have the same issue with the traffic being sent by the Standby ASA.  What do you think?

Hall of Fame Super Silver

Management access to remote ASA standby VPN peer

Hmmm, OK.

How about M0/0 as the access IP with a static for the /32 host address of the TACACS server(s) on the Management interface pointing to a gateway on a management VLAN address that is on a device (like a L3 switch) also off the inside interface? The more specific static route beats everything but a connected interface as far as routing goes so that should force the AAA out that path.

What is it you want to access the standby unit for anyhow?