Solved

ASA 5505 Peer Settings, originate only for a redundant peer IP?

Posted on 2014-11-24
2
597 Views
Last Modified: 2014-12-02
I have a 5505 with a vpn tunnel to the main site, this is the primary IP in the crypto map. The redundant IP in the crypto is to another firewall. The thought was that if the primary vpn tunnel goes down, or the primary IP is not reachable for any reason then the 5505 would automatically connect to the secondary redundant IP in the crypto map, the secondary firewall. But, upon further reading it seems that the connection type on the 5505 would need to be set as "connection-type originate-only". Is that true? I had it set as bidirectional. In the ASDM, when you edit the crypto map it says:

 "Uni-directional connection type policies are used for LAN-to-LAN redundancy. Tunnel policies of the "Originate Only" connection type may specify up to 10 redundant peers".

So if my purpose is for the 5505 to connect to a primary 5520, and if that isn't available to connect to another 5520, then I would use the "originate only" on the 5505? Would I change the 2 other crypto maps on the other firewall listening to "answer only"?

crypto map outside_map1 2 match address outside_cryptomap
crypto map outside_map1 2 set pfs group5
crypto map outside_map1 2 set peer "ASA 5520 #1 IP Address" "ASA 5520 #2 IP Address"
crypto map outside_map1 2 set ikev1 transform-set TransformSet
crypto map outside_map1 2 set nat-t-disable


Thanks.
0
Comment
Question by:tolinrome
2 Comments
 
LVL 57

Accepted Solution

by:
Pete Long earned 500 total points
ID: 40463977
Whenever I've set this up before - I've never set originate-only and I've not had a problem, though I'm usually seting both peer addresses to two addresses on the SAME firewall (i.e, ISP failover)
0
 
LVL 7

Author Comment

by:tolinrome
ID: 40464450
Thanks, I'll take a look at the article you inserted.
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
DNS and NSLOOKUP 21 75
CCNA lab 6 37
Voicemail on Cisco Unity Express unit has quit working 6 27
How difficult is it to migrate from Cisco ACS to Cisco ISE? 2 21
From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
This is an article about my experiences with remote access to my clients (so that I may serve them) and eventually to my home office system via Radmin Remote Control. I have been using remote access for over 10 years and have been improving my metho…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question