failover ASA with 2 different outside interfaces

Unanswered Question
Mar 28th, 2008
User Badges:

I would like to deploy the following and would like to know if it is feasible and advisable:


I would like to have 2 ASA's in failover mode with:


-one inside interface

-one DMZ interface

-TWO outside interfaces connected to two different ISP's (to the Internet), this is the part I am unsure about.


I have never seen or deployed such a setup before.


Some issues I thought of with this setup:


-port 25 from the Internet : what would the static NAT look like? Since there is only one DMZ, that is not an issue, but what would be the outside address of the static NAT? Or is there a need for 2 NAT's, one for each outside segment?


-routing : of the two circuits, one is a 10MG and one is a DSL, so the primary path should be the 10MG and backup is the DSL, should HSRP be setup on the firewall?


Please see attachment for the details



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
cpembleton Sun, 03/30/2008 - 17:48
User Badges:
  • Silver, 250 points or more

With 7.2(1) or later they added the ability to track routes which is what you'll need for your setup. I assume your running Active/Standby, if not please advise as it changes everything.


Remember this works with no issues for outbound and return traffic, If your hosting services like mail make sure you setup all your DNS with the backup IP's or those services won't work on the backup.


This link should provide your solution.

http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml#req


There is a bug in with route tracking and failover. See bug report and make sure your running a ver that has been fixed.

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsd51407


There are other ways of doing this but are more involved to setup. Like using 1 outside interface and running HSRP on your edge routers and having each ISP agree to advertise your other ISP block. Or doing NAT again out your backup ISP but can cause issues depending out what services your running.


Thanks,

Chad


Please rate if helpful!

Actions

This Discussion