Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Below is the network topology I will be working with. The left just shows that all sites have a single internet connection. The right shows how I would be setting up the VPN tunnels. The main concern for these sites is that if the internet connection to site 1 goes down the other sites will still have access to site 2. This is needed so the phones will continue to work.

enter image description here

Just wanting to get some input on if there is a better way to do this or some pitfalls I should look out for.

share|improve this question
Site 1 and site 2 have distinct IP ranges so that you can split between them with crypto maps, right? And will there ever be any need for sites 3, 4, and 5 to talk to each other? An MPLS or DMVPN deployment may preserve your sanity a bit better than this if you need anything more complicated than to have the bottom 3 sites talk to specific networks at sites 1 and 2 - your link between 1 and 2 would imply that it's more complicated than that? – Shane Madden Jan 5 '12 at 20:54
up vote 1 down vote accepted

You are calling the connections WAN connections but also indicate they are Internet connections. Which is it? If they are WAN connections, you should look into Metro-Ethernet. Metro-E links at each site will create a mesh so that all sites can talk to one-another regardless of any one site going down.

If they are Internet connections - yeah that ought to work but you wouldn't necessarily need the extra link between sites 1 and 2 unless you wanted it.

share|improve this answer
Every site just has a internet connection, no metero-e, mpls, etc. There are servers at site 1 and site 2 so that is why there would be a L2L VPN between them. I guess I should have been more clear. L2L VPNS are the only option I just wanted to make sure there wasn't something the ASA could offer that was better then the L2L VPN route. – evolvd Jan 6 '12 at 2:24
not that I'm aware of. – Paul Ackerman Jan 6 '12 at 20:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.