I currently have a simple site-to-site VPN setup, connecting machines from site 1 to site 2 through 1 ISP, using a set of ASA 5506X. All is good.

I'd like to "double" that setup for redundancy:

  • 2 ISPs
  • 2 sets of 2 ASA
  • both tunnels up at the same time
  • both tunnels usable by machines on site 1 and 2 at the same time

I feel it's mostly a NAT issue and I'm getting a bit confused

enter image description here

I would like to be able to "choose" the tunnel to be used by selecting a different IP address to connect to the SERVER from the PC (in ping or ssh, or any client / server application on my PC). I would essentially connect to the SAME SERVER, but depending on the IP I point to, I would use tunnel A or tunnel B.

At the moment I have a static route on the PC to use to hit

Ideally, I would:

  • define another target IP for the SERVER (let's say
  • add a route on the PC to use to get there
  • add some NAT on the receiving ASA to point back to

Would that work ? I feel I'm missing something...

Would the SERVER then be able to reply using that same Tunnel ?

I would appreciate any insight on this, thanks


2 Answers 2


You're creating an asymmetric routing situation. The destination may be different, but the source will be the same, so return traffic will always flow across the same ("default") tunnel.

One way to get around this is to do "twice nat"; rewrite source and destination. This doesn't necessarily have to happen on the same ASA, but often makes more logical sense. (i.e. one place for everything to "go wrong") This would look a lot like a standard "home network" NAT, where the inside LAN looks like a single address to the outside, but with a little more finesse 1:1 network translation would also work. (eg. <->

[I've had this sort of dualing-rewrite once before, and it was always confusing to everyone involved. The src:dst in my network are totally different from what they are in the other network.]

Additionally, if you add a router where you have pictured a switch, ECMP (and flow based route cache to avoid the mess of asymmetry and per-packet link selection) could load balance traffic across the tunnels as if they were direct links. No NAT trickery would be necessary, and nothing would have to change to select one path or the other. (Of course, this assumes the paths are equal cost. If one is 20ms and the other 100ms, that's not so equal.)

  • if I get this right, I would only need to do "twice NAT" on the ASA B1, and define a static route on my PC, correct ? Nothing to be done on the other side of the VPN (which is ideal as I don't have too much control on it), apart from configuring the interesting traffic & crypto map for the NATed source IP, correct ?
    – Bastien
    Mar 30, 2021 at 4:37
  • 1
    Perfect, it works, thanks Ricky. I played around with configuration but eventually managed to write something pretty concise and not too confusing, applying NAT to both src & dst, mapping whole subnets, ideal. One important information to note: "An ACL for VPN traffic uses the source and destination IP addresses after Network Address Translation (NAT)". Now will need to load test before production, but it's very encouraging.
    – Bastien
    Apr 15, 2021 at 1:14

Do yourself a favor and don't use NAT where it's not required. You're tunneling between private address areas and there's no address collision, whence no need to complicate things with using NAT.

Once you're routing transparently, you've simply got two paths between the networks. I'd use policy routing with fall back. ECMP requires session tracking and stickiness to prevent out-of-order packets.

  • The key problem with his design is making the host decide which path to use by static routes to one firewall or the other. It's bad practice to have multiple gateways in a single (access) LAN.
    – Ricky
    Mar 30, 2021 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.