1. Home
  2. Cisco Systems
  3. ASA - ISP backup

ASA - ISP backup

Hello, Hopefully someone else has done this before or has some info on how it can be implemented. In a nutshell I have a fairly large WAN setup with fiber and T1's to remote sites all using OSPF routing protocol. The main site has an ASA 5520 with a 5mb pipe to the internet via a switch. The ISP is also going to drop a second Internet connection to one of the other locations (which we are making into a backup data center) The ISP is also going to provide failover using BGP. So the IP Addresses at both sites will be the same. I was hoping to be able to use a second ASA and supply a backup internet connection for the main site.

MAP-

Internet Internet | | ASA ASA | | LAN--------router---fiber---router--------LAN ospf

My problem is the ASA will never show the internet down as OSPF is link state specific and even if the internet is down the ASA would still be connected to the internet switch and live. So I figured I can setup route tracking on the ASA but all the documentation shows using the backup ISP that is connected to a second interface on the ASA. I need the networks Default gateway to be the ASA on the other network that is connected via Fiber.

Is what I am looking for possible with the ASA or am I just spinning my wheels.

Thanks in advance for any information anyone may provide. As always its appreciated.

J.P. Plante

Reply to
JP Plante
Loading thread data ...

Your setup can't be implemented this way. You need two BGP able routers toward the internet, a direct connection between them (using VLAN, STUN, DLSW+ or FrameRelay over the Fiber). So you can set up the usual ASA active-active failover.

Reply to
Lutz Donnerhacke

Yeah I was planning on putting routers in front of the ASA for the BGP part of it. The part I am having trouble with is...How will the ASA know to perform the failover? How will the ASA know the link is down? And how will the default route get populated on all the other routers? Not to mention the other site is of course on a separate subnet. Thanks for the input I will re-read the active-active approach and see what I missed.

Thanks again.

J.P. Plante

Reply to
JP Plante

If the Router is down. Or the ASA. Or the inside switch. Or the whole site.

The ISP links are covered by the BGP routers.

Not necessary. The Routers speak iBGP between themself on a direct link. The ASA speak to the router. Each one to the next router. Active-Active setup.

Reply to
Lutz Donnerhacke

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.