Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a couple of branch offices that need to connect to a main site. We plan to use Cisco ASAs 5515 to establish VPN connections. We would also like to have 2 ISPs at each location to make the connection redundant. Here is the image: enter image description here

I am a bit new to ASAs so far, so my question is "Is it possible to set up ASA 5515 to use 2 ISPs to have VPN connection with a remote site and in case of the main ISP's failure switch over to backup ISP automatically and then to return back to the main one when the link is reestablished ?"

share|improve this question
up vote 2 down vote accepted

Yes it is possible, all you have to do is enable isakmp on the both outside interfaces of the redundant ISP ASA with

crypto isakmp enable <outside interface name>
crypto isakmp enable <backup interface name>

and then on the ISP C ASA change your crypto map statement to:

crypto map outside_map <crypto map no> set peer <ISP A IP> <ISP B IP>

That will allow a failover if ISP A is down. When the tunnel is renegotiated and ISP A is available the tunnel will fail back.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.