adding ASA for only VPN routes

[deanwebb]

Noice. Thanks for the link, javentre.

[scottsee]

I pulled the trigger today and bought 2 x ASA 5525-X to put into Active/Active ... Should get them tomorrow.. 

[wintermute000]

I hate to tell you this but you can't route over an ASA IPSEC VPN because for some retarded reason Cisco decided that GRE is no good on an ASA.

Hence no encapsulation hence no VTIs hence no routing protocols over your VPNs.

Throughput will beat the pants off a router but for routing failover purposes you're going to have to find another way e.g. IP SLA and/or duct tape aka route-maps somewhere else.
Whereas if you ran IPSEC tunnels from VTI interfaces or DMVPN on an ISR you could have run any IGP or BGP over the top.


Dean or another guru may come in and stomp me with new knowledge but that was the case when I was heavily ASA-ing a couple of years back and I haven't seen anything new in this regard

[Netwörkheäd]

This is why we're looking at Juniper and Checkpoint as VPN solutions.