1

I'm trying to configure two Site to Site VPNs from one Cisco ASA 5585x to two separate FWs with different ISPs. I found that multiple peer IP addresses can be configured under ASDM, Configuration > Site-to-Site VPN > Advanced > Crypto Maps... Editing crypto map and adding a secondary IP address. These peers need to be configured with matching crypto map and isakmp setting to the tunnel to work.

Will this work?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 15, 2017 at 5:07

1 Answer 1

Reset to default
2

Yes this will work if you use IKEv1. IKEv2 with multiple peers in the same crypto map entry is currently not supported on ASA.

Note that this scenario will not create 2 simultaneous tunnels. The ASA will attempt to set up a tunnel to the primary peer, and if that fails, will try to set up a tunnel to the secondary peer.

Also note that the remote ASAs will have to do RRI (reverse route injection) to make sure that the return traffic flows through the ASA with the active tunnel.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.