我有Cisco ASA 5505 8.2（5） - ASA_1在主办公室配置了三个接口：
outside - aaa.aaa.aaa.aaa
backup - bbb.bbb.bbb.bbb
inside - 192.168.10.1
在外部和备份之间切换配置为sla监视器和轨道：
sla monitor 1
type echo protocol ipIcmpEcho 212.116.103.121 interface outside
num-packets 3
frequency 10
sla monitor schedule 1 life forever start-time now
!
track 1 rtr 1 reachability
!
route outside 0.0.0.0 0.0.0.0 aaa.aaa.aaa.121 1 track 1
route backup 0.0.0.0 0.0.0.0 bbb.bbb.bbb.65 10
route inside 0.0.0.0 0.0.0.0 192.168.10.1 tunneled
和远程办公室中的ASA_2相同，有两个接口：
outside - ccc.ccc.ccc.ccc
里面 - 192.168.2.1
我在它们之间构建了VPN隧道。当ASA_1上的外部接口关闭时，流量将通过备份接口。但在这种情况下，我的隧道瘫痪了。
我已经将加密映射添加到备份接口：
crypto map vpdn 1 match address outside_1_cryptomap
crypto map vpdn 1 set pfs group1
crypto map vpdn 1 set peer ccc.ccc.ccc.ccc
crypto map vpdn 1 set transform-set ESP-DES-SHA
crypto map vpdn 10 ipsec-isakmp dynamic vpdn-map
crypto map vpdn interface outside
crypto map vpdn interface backup
并在ASA_2中配置第二个隧道（备份ip为peer）：
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group1
crypto map outside_map 1 set peer aaa.aaa.aaa.aaa
crypto map outside_map 1 set transform-set ESP-DES-SHA
crypto map outside_map 2 match address outside_1_cryptomap
crypto map outside_map 2 set pfs group1
crypto map outside_map 2 set peer bbb.bbb.bbb.bbb
crypto map outside_map 2 set transform-set ESP-DES-SHA
crypto map outside_map interface outside
正如您所看到的，两个加密映射都使用相同的acl。
但是当我关闭外部接口时，ASA_1中的数据包跟踪器（从主LAN到远程）显示以下内容：
...
Phase: 11
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information:
Forward Flow based lookup yields rule:
out id=0xd8e3d950, priority=70, domain=encrypt, deny=false
hits=0, user_data=0x0, cs_id=0xd8e99c80, reverse, flags=0x0, protocol=0
src ip=192.168.10.0, mask=255.255.255.0, port=0
dst ip=dop-off1, mask=255.255.255.0, port=0, dscp=0x0
Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
外部接口启动时ASA_2中的ASA_2（从远程LAN到main）
sh isakmp输出相同：
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: ccc.ccc.ccc.ccc
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
当外面下来时，isakmp根本没有隧道。当ASA_1上的外部接口处于启动状态或处于关闭状态时，ASA_2上的
sh isakmp输出：
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: aaa.aaa.aaa.aaa
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE
我怎么解决这个问题？
PS抱歉我的英文，我来自俄罗斯）