Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have Cisco ASA 5505 8.2(5) - ASA_1 in main office configured with three interfaces:
outside - aaa.aaa.aaa.aaa
backup - bbb.bbb.bbb.bbb
inside - 192.168.10.1
Switching between outside and backup is configured with sla monitor and tracks:

sla monitor 1  
 type echo protocol ipIcmpEcho 212.116.103.121 interface outside  
 num-packets 3  
 frequency 10  
sla monitor schedule 1 life forever start-time now  
!  
track 1 rtr 1 reachability  
!  
route outside 0.0.0.0 0.0.0.0 aaa.aaa.aaa.121 1 track 1  
route backup 0.0.0.0 0.0.0.0 bbb.bbb.bbb.65 10  
route inside 0.0.0.0 0.0.0.0 192.168.10.1 tunneled  

And the same ASA_2 in remote office with two interfaces:
outside - ccc.ccc.ccc.ccc
inside - 192.168.2.1
I've built the VPN tunnel between them. When outside interface on ASA_1 is down, traffic goes through the backup interface. But in this case my tunnel goes down.
I've added crypto map to the backup interface:

crypto map vpdn 1 match address outside_1_cryptomap  
crypto map vpdn 1 set pfs group1  
crypto map vpdn 1 set peer ccc.ccc.ccc.ccc  
crypto map vpdn 1 set transform-set ESP-DES-SHA  
crypto map vpdn 10 ipsec-isakmp dynamic vpdn-map  
crypto map vpdn interface outside  
crypto map vpdn interface backup

and configured the second tunnel in ASA_2 (with backup ip as peer):

crypto map outside_map 1 match address outside_1_cryptomap  
crypto map outside_map 1 set pfs group1  
crypto map outside_map 1 set peer aaa.aaa.aaa.aaa  
crypto map outside_map 1 set transform-set ESP-DES-SHA  
crypto map outside_map 2 match address outside_1_cryptomap  
crypto map outside_map 2 set pfs group1  
crypto map outside_map 2 set peer bbb.bbb.bbb.bbb  
crypto map outside_map 2 set transform-set ESP-DES-SHA  
crypto map outside_map interface outside  

as you can see both crypto maps use the same acl.
But when i turn off outside interface, packet-tracer in ASA_1 (from main LAN to remote) displays the following:

...  
Phase: 11  
Type: VPN  
Subtype: encrypt  
Result: DROP  
Config:  
Additional Information:  
 Forward Flow based lookup yields rule:  
 out id=0xd8e3d950, priority=70, domain=encrypt, deny=false  
        hits=0, user_data=0x0, cs_id=0xd8e99c80, reverse, flags=0x0, protocol=0  
        src ip=192.168.10.0, mask=255.255.255.0, port=0  
        dst ip=dop-off1, mask=255.255.255.0, port=0, dscp=0x0

Result:  
input-interface: inside  
input-status: up  
input-line-status: up  
output-interface: inside  
output-status: up  
output-line-status: up  
Action: drop  
Drop-reason: (acl-drop) Flow is denied by configured rule  

And the same in ASA_2 (from remote LAN to main)
sh isakmp output on ASA_1 when outside interface is up:

Active SA: 1  
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)  
Total IKE SA: 1

1   IKE Peer: ccc.ccc.ccc.ccc  
    Type    : L2L             Role    : initiator  
    Rekey   : no              State   : MM_ACTIVE  

when outside is down sh isakmp shows no tunnels at all.
sh isakmp output on ASA_2 either when outside interface on ASA_1 is up or it's down:

Active SA: 1  
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)  
Total IKE SA: 1

1   IKE Peer: aaa.aaa.aaa.aaa  
    Type    : L2L             Role    : initiator  
    Rekey   : no              State   : MM_ACTIVE  

How can i solve this problem?

P.S. Sorry for my english, i'm from Russia)

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.