I have Cisco ASA 5505 8.2(5) - ASA_1 in main office configured with three interfaces:
outside - aaa.aaa.aaa.aaa
backup - bbb.bbb.bbb.bbb
inside - 192.168.10.1
Switching between outside and backup is configured with sla monitor and tracks:
sla monitor 1 type echo protocol ipIcmpEcho 188.8.131.52 interface outside num-packets 3 frequency 10 sla monitor schedule 1 life forever start-time now ! track 1 rtr 1 reachability ! route outside 0.0.0.0 0.0.0.0 aaa.aaa.aaa.121 1 track 1 route backup 0.0.0.0 0.0.0.0 bbb.bbb.bbb.65 10 route inside 0.0.0.0 0.0.0.0 192.168.10.1 tunneled
And the same ASA_2 in remote office with two interfaces:
outside - ccc.ccc.ccc.ccc
inside - 192.168.2.1
I've built the VPN tunnel between them. When outside interface on ASA_1 is down, traffic goes through the backup interface. But in this case my tunnel goes down.
I've added crypto map to the backup interface:
crypto map vpdn 1 match address outside_1_cryptomap crypto map vpdn 1 set pfs group1 crypto map vpdn 1 set peer ccc.ccc.ccc.ccc crypto map vpdn 1 set transform-set ESP-DES-SHA crypto map vpdn 10 ipsec-isakmp dynamic vpdn-map crypto map vpdn interface outside crypto map vpdn interface backup
and configured the second tunnel in ASA_2 (with backup ip as peer):
crypto map outside_map 1 match address outside_1_cryptomap crypto map outside_map 1 set pfs group1 crypto map outside_map 1 set peer aaa.aaa.aaa.aaa crypto map outside_map 1 set transform-set ESP-DES-SHA crypto map outside_map 2 match address outside_1_cryptomap crypto map outside_map 2 set pfs group1 crypto map outside_map 2 set peer bbb.bbb.bbb.bbb crypto map outside_map 2 set transform-set ESP-DES-SHA crypto map outside_map interface outside
as you can see both crypto maps use the same acl.
But when i turn off outside interface, packet-tracer in ASA_1 (from main LAN to remote) displays the following:
... Phase: 11 Type: VPN Subtype: encrypt Result: DROP Config: Additional Information: Forward Flow based lookup yields rule: out id=0xd8e3d950, priority=70, domain=encrypt, deny=false hits=0, user_data=0x0, cs_id=0xd8e99c80, reverse, flags=0x0, protocol=0 src ip=192.168.10.0, mask=255.255.255.0, port=0 dst ip=dop-off1, mask=255.255.255.0, port=0, dscp=0x0 Result: input-interface: inside input-status: up input-line-status: up output-interface: inside output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule
And the same in ASA_2 (from remote LAN to main)
sh isakmp output on ASA_1 when outside interface is up:
Active SA: 1 Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey) Total IKE SA: 1 1 IKE Peer: ccc.ccc.ccc.ccc Type : L2L Role : initiator Rekey : no State : MM_ACTIVE
when outside is down sh isakmp shows no tunnels at all.
sh isakmp output on ASA_2 either when outside interface on ASA_1 is up or it's down:
Active SA: 1 Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey) Total IKE SA: 1 1 IKE Peer: aaa.aaa.aaa.aaa Type : L2L Role : initiator Rekey : no State : MM_ACTIVE
How can i solve this problem?
P.S. Sorry for my english, i'm from Russia)