site to site VPN - Dynamic routes with BGP do not work.

Question

Hi,  
  
in one of our ofices we have Cisco ASA firewall connected to 2 providers.  
  
2 site to site VPNs with 2 tunnels on each were created.  
  
1 provider is working in active mode and firewall will only use 2 providers if 1 line goes down.  
  
If all tunnels are up, site to site VPN is not working.  
  
If I disable 2 tunnels on active connection traffic is flowing.  
  
If I disable 2 tunnels on passive connection and 1 tunnel on active connection traffic is passing.  
  
The only workaround I have found for now is to disable 1 tunnel on active connection and add static route which is sending traffic over the 2nd tunnel.  
  
Support case with cisco was created and they are telling me that it is AWS fault, traffic is going from the tunnel but not coming back.  
  
Has anyone had the same issue? I may suspect asymmetric routing in this case.

Vasily · Answer

I have managed to find a solution for asynchronous routes over 4 tunnels after watching this video:  
https://www.youtube.com/watch?v=SMvom9QjkPk&feature=youtu.be&t=10m5s  
  
using  set local-preference(higher number is more preferable) and  set as-path prepend parameters on Cisco Asa firewall for prioritizing traffic in and out.  
  
router bgp 65000  
 address-family ipv4 unicast  
	neighbor x.x.x.x route-map LOCALPREF-400 in  
	neighbor x.x.x.x route-map PREPEND-X1 out  
	neighbor y.y.y.y route-map LOCALPREF-350 in  
	neighbor y.y.y.y route-map PREPEND-X2 out  
	neighbor z.z.z.z route-map LOCALPREF-300 in  
	neighbor z.z.z.z route-map PREPEND-X3 out  
	neighbor a.a.a.a route-map LOCALPREF-250 in  
	neighbor a.a.a.a route-map PREPEND-X4 out  
	  
! higher number is more preferable  
  
route-map LOCALPREF-250 permit 10  
 set local-preference 250  
!  
  
route-map LOCALPREF-300 permit 10  
 set local-preference 300  
!  
  
route-map LOCALPREF-350 permit 10  
 set local-preference 350  
  
route-map LOCALPREF-400 permit 10  
 set local-preference 400  
   
route-map PREPEND-X1 permit 10  
 set as-path prepend 65000  
  
route-map PREPEND-X2 permit 10  
 set as-path prepend 65000 65000  
  
route-map PREPEND-X3 permit 10  
 set as-path prepend 65000 65000 65000  
   
route-map PREPEND-X4 permit 10  
  set as-path prepend 65000 65000 65000 65000  
  
I hope it may help to somebody.  
  
Edited by: Vasily on Jan 25, 2019 11:35 AM

Vasily · Answer

it resolved my problem with 4 VPN tunnels

leonblc · Answer

Hi Vasily  
  
This also helped me out a lot with my Transit Gateway VPN attachment to our Cisco ASA firewall. With the VPN ECMP option enabled. So thanks a bunch!  
  
Greetz Leon

site to site VPN - Dynamic routes with BGP do not work.

Relevant content