I am configuring L2L VPN between two sites through the internet. Site 1: I have ASA with ADSL connection and dynamic Idlls5szltldup Site 2: I have ASA also with two internet lines ,leased line with static IP and ADSL line with dynamic IP . I have configured the VPN and it is up and running only when I configure default t7zroute through the lease line ,but if I configured the default route through the ADSL the VPN will go down I have on both ASA version 9.4 and PBR is there but i am not sure if PBR can resolve that .

  • You should only use a default route on an Interface where you don't know, the addressing on the other side, e.g. the Internet. For a site-to site connection, you should know the networks on the other side, so you can run a routing protocol or configure static routes.
    – Ron Maupin
    Oct 8, 2016 at 18:39
  • I want to use the ADSL for normal Internet traffic so I need default route and use the lease line only for vpn
    – Mr.lock
    Oct 8, 2016 at 18:42
  • Then you need to set up static routes or a routing protocol between the sites. I'm not sure why a leased line needs a VPN. A leased line should be inherently secure.
    – Ron Maupin
    Oct 8, 2016 at 18:43
  • No it is called here internet lease line which mean symtric Internet connection with static IP
    – Mr.lock
    Oct 8, 2016 at 18:45
  • 1
    @Mr.lock what is your question? When the default route points to the ADSL do you want the vpn to go over the ADSL or still over the leased line?
    – hertitu
    Oct 8, 2016 at 20:53

1 Answer 1


Let me recap what you are trying to achieve. On site A you got two ISPs. One Uplink is used for Internet traffic (A) and the other Uplink (B) should only be used for Site2Site VPNs.

You are trying to establish a Site2Site VPN from B to a site that has no static ip address.

One could argue that you could just add a /32 Host Route on B to ensure this is working but since you have a Dynamic Peer this wont work.

I would recommend using Security Context feature on ASA. Depending on your model and license you can segment your firewall into multiple logical firewalls. Since you would have a different routing table for your VPN context you would not have any problems.

Let me know which model you are using and if this was an option for you.

  • IPsec is not supported on ASA in case of mutiple context
    – Mr.lock
    Oct 10, 2016 at 12:48
  • This is not correct. The limitation existed at some point, but not anymore...
    – kaisero
    Oct 10, 2016 at 13:18
  • For completeness: S2S VPN in Multiple Context Mode is supported since v. 9.0 on ASA
    – kaisero
    Oct 10, 2016 at 15:29
  • So both contexts would have a default route, but share the inside interface? How would traffic from the inside get classified to the correct context?
    – hertitu
    Oct 11, 2016 at 23:01
  • 1
    Please do not use static routes on your end-devices. Just create a 2nd context and add a route from Context A (Internet Outbreak, routes Inside-LAN) to Context B (VPN Outbreak). Add a static route from one context to the other but make sure to use a transport network for traffic symmetry (in case you route from Context A to Context B using the same network your clients reside in, this will result in asymmetric traffic flow).
    – kaisero
    Oct 12, 2016 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.