Solved

Home office WAN/VPN failover (Cisco ASA) - design

Posted on 2012-04-08
5
392 Views
Last Modified: 2014-06-09
A customer is looking for an improved home teleworker solution beyond the current point-to-point T1 data connections to the main office. The plan is to deploy a secondary connection to each home over broadband cable (over Mediacom/US), and have this higher-speed link provide the primary connection over VPN. If this connection drops, they'd like the existing T1 connection to serve as the backup, and have connectivity immediately fail-over.

The main office is currently being served by a Cisco ASA 5520, and an ASA 5505 can be deployed at each home office to provide for the VPN connection over the cable connection. The existing connection looks like this:

      Main --- T1 router ------WAN------- T1 router ----Home

Adding an ASA to this at the home office would possibly look like the following:

     Main --- T1 router ------ WAN ------T1 router ----ASA ----home PC
          |                                                                      |  
           ---- ASA ------------ Internet ---------------Cable modem

So, the new ASA at the home office would front both the T1 (non-VPN) connection as well as the VPN connection over the new cable connection.  I need to resolve the following questions:

1) Will the above design work?  Can an ASA be configured to send all data over a VPN connection, and then somehow when the VPN drops, start sending data over the unencrypted T1 WAN connection?  (Plus, failing back to the cable connection when it becomes available once more...)

2) If so, looking for some configuration guidance for the ASA on how this would be accomplished.

Thank you - reference links/docs are always appreciated.
0
Comment
Question by:cfan73
  • 2
5 Comments
 
LVL 10

Accepted Solution

by:
rscottvan earned 500 total points
ID: 37823374
Here's an article describing how to configure the WAN failover:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

I'm thinking you can just create a tunnel on the cable side and route traffic to it, and let traffic drop when you route over the T1, since it's private.  If you need a tunnel on both sides, just build 2 tunnels, and set up the routing to send traffic to the cable tunnel first, then the T1 tunnel if the cable connection drops.

Here's another article with a VPN as well:
http://www.petenetlive.com/KB/Article/0000544.htm
0
 

Author Comment

by:cfan73
ID: 37826003
Thanks for the response.

I've seen the first document before, and the current situation differs in that the backup circuit  is not a 2nd Internet service provider, but a direct WAN connection back to the main site. (Thus, it's already there and terminated by a local 1721 router, and wouldn't have to pass through the new 5505 ASA.)  I'm not sure if this changes the design/configuration, but it might...

Would this work?:

- Configure IP SLA across the new (VPN) connection to the outside interface of the head-end ASA, with link tracking.
- Configure a default route on the ASA to this same interface IP.
- Configure static route(s) on the ASA w/ a higher administrative distance (so, floating)
to the remote nets over the T1 WAN connection.

Thanks again
0
 

Author Comment

by:cfan73
ID: 37840856
bump for additional input?
0
 
LVL 69

Expert Comment

by:Qlemo
ID: 40121905
I've requested that this question be deleted for the following reason:

The question has either no comments or not enough useful information to be called an "answer".
0

Featured Post

Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
IPSec Site to Site VPN Topology 6 64
pptp through Cisco ASA5505 V7 5 30
VPN Tunnel Stops Working Cisco RV130W 18 49
Remote laptop can't connect to mapped shared drive 14 52
OpenVPN is a great open source VPN server that is capable of providing quick and easy VPN access to your network on the cheap.  By default the software is configured to allow open access to your network.  But what if you want to restrict users to on…
Introduction This article explores the design of a cache system that can improve the performance of a web site or web application.  The assumption is that the web site has many more “read” operations than “write” operations (this is commonly the ca…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question