topic VPN tunnel redundancy on CP and also on ASA-peer. Any way to achieve dual VPN on both sides? in Firewall and Security Management

VPN tunnel redundancy on CP and also on ASA-peer. Any way to achieve dual VPN on both sides?

YuvrajMe147 — Tue, 02 Nov 2021 20:22:52 GMT

CP Checkmates,!

The setup we have in place for SITE to SITE VPN:

Star community has 2 CP Clusters defined and 1 ASA object under satellite. MEP has enabled hence the failover works fine should one of the CPs become unresponsive.

SMS/Gateways are at R80.30.

Requirement:

We need to add redundancy on the peer side as well. (Basically, one more peer needs to be added along with ASA-Main, which would be ASA-DR.)

Problem:

When we add ASA-DR, along with ASA-Main, both tunnels come up and cause an outage.
For now, we have removed the ASA-DR to keep the setup in a working state.

I am looking for any possible solutions, please.

Thanks,
YM

Re: VPN tunnel redundancy on CP and also on ASA-peer. Any way to achieve dual VPN on both sides?

YuvrajMe147 — Thu, 04 Nov 2021 16:25:28 GMT

Is there anyone who could shed a light on this topic?

Re: VPN tunnel redundancy on CP and also on ASA-peer. Any way to achieve dual VPN on both sides?

mcatanzaro — Fri, 05 Nov 2021 04:11:21 GMT

I’m not 100% on if this would work but am chiming in since there aren’t any responses yet.

In my head it seems like a route based VPN could work for this setup.

I would imagine you could set priorities on the routes for relevant traffic to prefer the primary peer.