Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Static Route redundancy for connected route and vpn tunnel

I will try to make this question as simple as possible.

I have a ASA that is connected directly to a remote site via a p2p metro ethernet circuit.  Therefore, the ASA has an interface on that "remote" network.  In the firewall, the network is a connected route.  I will use 192.168.1.0/24 as the network.

I want to create a redundant path to the remote site via a VPN over our Internet connections.  How do I set up the tunnel and the routing to make this happen?  I get the tunnel set up no problem.  How do I get traffic destined for 192,168.1.0/224 to go over the VPN as opposed to the directly connected route when that connection fails?

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Static Route redundancy for connected route and vpn tunnel

When using:

route p2p 192.168.1.0 255.255.255.0 x.x.x.x 10

route vpn 192.168.1.0 255.255.255.0 y.y.y.y 20

x.x.x.x will be the next-hop when going out the p2p interface.

y.y.y.y will be the next-hop when going out the VPN interface.

Which IP do you have on the p2p and on the VPN (internet) interface?

Federico.

6 REPLIES

Re: Static Route redundancy for connected route and vpn tunnel

Hi,

The ASA has an interface belonging to the p2p link (not to the remote network), so you can have a VPN tunnel configured via another interface to reach that remote network.

However, the VPN tunnel will have to terminate on a different IP (not the other end of the p2p link), because the ASA will only use its own interface on the p2p link to reach the other end of the p2p link.

Federico.

Community Member

Re: Static Route redundancy for connected route and vpn tunnel

The vpn tunnel does terminate on the Internet interface of that remote router.

I can set up a tracking object to tell me when the p2p link goes down.  I just need to know how to force the traffic over the VPN tunnel as opposed to the connected route?

What should or can i use as the next hop address for the route statement?

Re: Static Route redundancy for connected route and vpn tunnel

Let's say you have this route on the ASA:

route p2p 192.168.1.0 255.255.255.0 x.x.x.x --> which is the next-hop over the p2p

You can do this:

route p2p 192.168.1.0 255.255.255.0 x.x.x.x 10

route vpn 192.168.1.0 255.255.255.0 y.y.y.y 20

So, the route through interface vpn will be used only when the p2p link is down.

Federico.

Community Member

Re: Static Route redundancy for connected route and vpn tunnel

So my question is what should y.y.y.y be?  I attached a basic diagram for reference.  You are being very helpful.  Thanks.

Re: Static Route redundancy for connected route and vpn tunnel

When using:

route p2p 192.168.1.0 255.255.255.0 x.x.x.x 10

route vpn 192.168.1.0 255.255.255.0 y.y.y.y 20

x.x.x.x will be the next-hop when going out the p2p interface.

y.y.y.y will be the next-hop when going out the VPN interface.

Which IP do you have on the p2p and on the VPN (internet) interface?

Federico.

Community Member

Re: Static Route redundancy for connected route and vpn tunnel

I got the answer from you.  Thanks for your help.

y.y.y.y = 33.33.33.1 from the drawing

705
Views
0
Helpful
6
Replies
CreatePlease to create content