cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
315
Views
0
Helpful
1
Replies

failover ASA with 2 different outside interfaces

ronshuster
Level 1
Level 1

I would like to deploy the following and would like to know if it is feasible and advisable:

I would like to have 2 ASA's in failover mode with:

-one inside interface

-one DMZ interface

-TWO outside interfaces connected to two different ISP's (to the Internet), this is the part I am unsure about.

I have never seen or deployed such a setup before.

Some issues I thought of with this setup:

-port 25 from the Internet : what would the static NAT look like? Since there is only one DMZ, that is not an issue, but what would be the outside address of the static NAT? Or is there a need for 2 NAT's, one for each outside segment?

-routing : of the two circuits, one is a 10MG and one is a DSL, so the primary path should be the 10MG and backup is the DSL, should HSRP be setup on the firewall?

Please see attachment for the details

1 Reply 1

cpembleton
Level 4
Level 4

With 7.2(1) or later they added the ability to track routes which is what you'll need for your setup. I assume your running Active/Standby, if not please advise as it changes everything.

Remember this works with no issues for outbound and return traffic, If your hosting services like mail make sure you setup all your DNS with the backup IP's or those services won't work on the backup.

This link should provide your solution.

http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml#req

There is a bug in with route tracking and failover. See bug report and make sure your running a ver that has been fixed.

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsd51407

There are other ways of doing this but are more involved to setup. Like using 1 outside interface and running HSRP on your edge routers and having each ISP agree to advertise your other ISP block. Or doing NAT again out your backup ISP but can cause issues depending out what services your running.

Thanks,

Chad

Please rate if helpful!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: