site to site VPN - Dynamic routes with BGP do not work.



in one of our ofices we have Cisco ASA firewall connected to 2 providers.

2 site to site VPNs with 2 tunnels on each were created.

1 provider is working in active mode and firewall will only use 2 providers if 1 line goes down.

If all tunnels are up, site to site VPN is not working.

If I disable 2 tunnels on active connection traffic is flowing.

If I disable 2 tunnels on passive connection and 1 tunnel on active connection traffic is passing.

The only workaround I have found for now is to disable 1 tunnel on active connection and add static route which is sending traffic over the 2nd tunnel.

Support case with cisco was created and they are telling me that it is AWS fault, traffic is going from the tunnel but not coming back.

Has anyone had the same issue? I may suspect asymmetric routing in this case.

asked 5 years ago1023 views
3 Answers

I have managed to find a solution for asynchronous routes over 4 tunnels after watching this video:

using set local-preference(higher number is more preferable) and set as-path prepend parameters on Cisco Asa firewall for prioritizing traffic in and out.

router bgp 65000
address-family ipv4 unicast
neighbor x.x.x.x route-map LOCALPREF-400 in
neighbor x.x.x.x route-map PREPEND-X1 out
neighbor y.y.y.y route-map LOCALPREF-350 in
neighbor y.y.y.y route-map PREPEND-X2 out
neighbor z.z.z.z route-map LOCALPREF-300 in
neighbor z.z.z.z route-map PREPEND-X3 out
neighbor a.a.a.a route-map LOCALPREF-250 in
neighbor a.a.a.a route-map PREPEND-X4 out

! higher number is more preferable

route-map LOCALPREF-250 permit 10
set local-preference 250

route-map LOCALPREF-300 permit 10
set local-preference 300

route-map LOCALPREF-350 permit 10
set local-preference 350

route-map LOCALPREF-400 permit 10
set local-preference 400

route-map PREPEND-X1 permit 10
set as-path prepend 65000

route-map PREPEND-X2 permit 10
set as-path prepend 65000 65000

route-map PREPEND-X3 permit 10
set as-path prepend 65000 65000 65000

route-map PREPEND-X4 permit 10
set as-path prepend 65000 65000 65000 65000

I hope it may help to somebody.

Edited by: Vasily on Jan 25, 2019 11:35 AM

answered 5 years ago

it resolved my problem with 4 VPN tunnels

answered 5 years ago

Hi Vasily

This also helped me out a lot with my Transit Gateway VPN attachment to our Cisco ASA firewall. With the VPN ECMP option enabled. So thanks a bunch!

Greetz Leon

answered 5 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions