Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

WAN Failover to VPN Help.

I have a site that has a single MPLS link to it,I have an ASA firewall out there connected to a DSL internet connection. My question is where can I find a good guide to help me configure routing my router or switch to use the ASA VPN tunnel back to my datacenter if the WAN link goes down.

Thanks for any help.



Re: WAN Failover to VPN Help.

Hi Mark,

You can failover to VPN using a Static route with higher AD .Let us assume that your network is routing protocol and it has a Dynamic route for remote subnet x.x.x.x. So you can add following static route on internal router.

ip route x.x.x.x y.y.y.y 200

So when the router looses dynamic route it will install this static route which points traffic towards ASA to VPN.



Pls rate helpful posts

New Member

Re: WAN Failover to VPN Help.

Thanks Saju, that part at the remote site I understand thanks to your help, but what I need to figure next is in my Datacenter what would I need to do to make sure subnet that comes in over the VPN tunnel goes back out the tunnel and not over the WAN.

New Member

Re: WAN Failover to VPN Help.


i undetstood that you are looking for the following scenario:

MPLS link is in Cisco Router & VPN Tunnel is in ASA Firewall. So Your requirement is that if MPLS Goes down VPN has to trigger automatically right.

If that is the scenario, Go ahead with the following steps.

it worked for me.

First you have to place a default route in the Router like as follows

ip route InsidelanID subnetmask ASAinterfaceIP

please find the attachement for ASA end Configuration Steps.

Pls Rate me if it help to you

New Member

Re: WAN Failover to VPN Help.

Thanks for the document, so say my remote location is 10.97.x.x and the 10.97.x.x is going over the vpn tunnel to my central data center, how will my core switch know not to send the 10.97.x.x out over the MPLS cloud, but back to the VPN tunnel.

New Member

Re: WAN Failover to VPN Help.

Hi - am running into a similar situation and did a search on forums and noticed your query. Wondering if you were able to resolve this.

my take is to have a similar static route for the remote site at the DC with a higher admin distance. So, at the remote site - you have a default route with say distance 250 pointing to the remote site firewall which terminates the VPN. And at the DC, you have static routes to the remote site subnets with a high distance pointing to the hub end of the firewall that terminates the vpn.

did you have a similar approach