Peer to same remote from VX-environment.

[950117ec-6722-4]

Hi ! I have problem with VPN tunnel in a VSX environment, I would like to build two VPN tunnel to the same remote peer-adress from two different VS, is that supported ?

My gateway-server is on 77.30 and the management-server on 80.10.

It look good from the beginning and booth of the tunnel rise, but after a while one of them goes down and

get "authentication failure" when the remote side tried to connect.   

The remote peer that I would like to peer with is located on a Juniper, Junos firewall.

Thank you for some help.

/Yngve  

[Vladimir]

Do your VS' have unique public IPs assigned to their external interfaces or are they behind common VSwitch or external router being NATed to the same public IP?

[950117ec-6722-4]

Booth of the VS have unique ip-addresses and are connected with a common VSwitch to Internet.

[950117ec-6722-4]

Some more information,

we use the same "Interoperable Device" object as gateway in two different VPN community type meshed and we don't use Multi domain management. Hopefully I describe the setup on this case. I have not yet tried

this setup to other vendors than Juniper, I will try to use a Cisco ASA but it looks that it should be some problem

in my CP environment.

[Maarten_Sjouw]

Are the 2 tunnels built in 1 community or in the same?

I would build 1 star community with the remote site as a center and set VPN routing to from satelite to center only.

This way you have 1 PSK for both tunnels, I have a customer running this type of setup with some different appliances to Amazon (although they are not VS's).

[950117ec-6722-4]

We have 2 separate community, because there are different company in each VS and they should not be dependent to each other.  But maybe I can build this as one community and deny traffic between the two satellite.

But does any know if my setup would bee possible, we are going to use MDM in a feature and does that change any in this case?

[Maarten_Sjouw]

This is why I said, build a Star with the REMOTE gateway as the CENTER, you can disallow traffic from one to the other VS.

[950117ec-6722-4]

But, when I build a start community I have only one of my VS that are the center gateway and if that one goes down the

traffic from the satellite to the other VS does not work.

A picture for no misunderstanding.