Connecting to Cisco ASA - Dual WAN

[barnettd]

Hi,

I am connecting a pfsense failover pair to a head end that uses a Cisco ASA running 9.x. The pfsense side has dual wans configured with a failover gateway group and carp vips. All seems to be working normally with that config.

The Cisco ASA has a feature to use multiple peers when setting up an IPSEC tunnel. When enabled, it will go through the peers in order until it can connect. The feature works great when connecting to other ASAs, but not so much with the pfsense. I suspect this is due to the pfsense side still passing traffic even if a gateway is marked as down.

Question:
Can I create firewall rules that activate/deactivate based on the active gateway as determined by the gateway group?

Also open to other options to resolve this.

Thanks