3

I currently have 2 Internet links, from different carriers. Our primary link currently has our VPN connections running over it. I want to add another VPN connection over the 2nd carrier. So I have 2 cisco 5545x's(Active/Standby) with carrier 1 on the OUTSIDE interface and carrier 2 coming over the OUTSIDE_1 interface. I have a cert for vpn.mysite.com that is associated to the OUTSIDE interface. I would like to associate vpn3.mysite.com to the OUTSIDE_1. Currently OUTSIDE_1 is not carrying any traffic at this time. Users are coming in with cisco anyconnect.

Do I need to re-engineer my Firewall setup to achieve this? Is it even possible to run that over an Active/Standby configuration?

As I think of it, I think the only way to do it is to make a cluster with a master and users pointing to a VIP?

Any help would be appreciated, thanks. 

sh run ssl  
ssl encryption 3des-sha1 aes128-sha1 aes256-sha1 dhe-aes128-sha1 dhe-aes256-sha1 rc4-md5 rc4-sha1
ssl trust-point ASDM_TrustPoint7 OUTSIDE_1
ssl trust-point vpn.mysite.com_trustpoint OUTSIDE
sh run webvpn
webvpn
 enable OUTSIDE
 enable OUTSIDE_1
 anyconnect-essentials
 anyconnect image disk0:/anyconnect-win-3.1.01065-k9.pkg 1
 anyconnect enable
 tunnel-group-list enable
 certificate-group-map DefaultCertificateMap 20 USER-SSL-VPN
 certificate-group-map DefaultCertificateMap 30 DefaultRAGroup
Improve this question
1
  • You can do it as is. The config that you have currently appears correct but we cannot say for certain without the rest that something else isn't preventing the connections. Also you don't specifically say what problem you're having. Are users trying to connect to vpn3.mysite.com and not getting a login prompt? What happens when you open vpn3.mysite.com in a browser? Are you having a cert error?
    – Chris Balmer
    Sep 8, 2015 at 19:44

3 Answers 3

Reset to default
1

For the scenario I wanted, it can only be done in a multi-homed environment. You need to have an AS to accomplish this.

The solution was to advertise your AS via BGP and then you can use any ISP you like. They will route back to your VPN addresses. In this case you only need 1 VPN address.

Improve this answer
1
  • Ran this by a Cisco Sales Engineer and he agreed, It is a Cisco validated design.
    – Security_Pete
    Mar 25, 2016 at 18:02
0

Terminate your ISP connections on a router, or routers. These routers plug into an outside switch/VLAN which plugs in to your security appliance.

rtrs---switch(outside)---firewall---switch(inside)

Improve this answer
2
  • I have 2 routers, one for each. My issue is that when I bring them to the firewall, I can't get both vpn's working at the same time.
    – Security_Pete
    May 27, 2015 at 19:22
  • Do you have the licensing to set these ASA's up in a active/standby failover mode?
    – Ronnie Royston
    May 27, 2015 at 21:31
0

Create a new trustpoint, and apply it to your OUTSIDE_1 interface.

Improve this answer
4
  • There are trustpoints for both interfaces
    – Security_Pete
    May 27, 2015 at 19:23
  • @Security_Pete You can create a second trustpoint, so that each of your interfaces have two different trustpoints applied. If that doesn't give you your solution, then I believe at this point there isn't much more help we can provide without getting more context and or configuration files.
    – Eddie
    May 27, 2015 at 19:30
  • I have seperate trustpoints for each
    – Security_Pete
    May 27, 2015 at 19:52
  • I added the config to the original post, let me know if you want any others displayed
    – Security_Pete
    May 27, 2015 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.