I request your expertised help to give solution to the issue I am encountering here. The detailed explanation is below
I have 2 Cisco Router connecting to ISP-1 & ISP-2 as shown it the diagram attached.
I want to use both the ISP actively. so the solution is opted is
1. HSRP with 2 instances
2. My customer strictly said GBLP should not be implemented for various reasons. So I cannot use GBLP.
3. When i created 2 instances, I get 2 Virtual IP address. say for example 192.168.1.100 & 192.168.2.100
4. But the restriction is in ASA FIREWALL only one default gateway (the first entry) is active. The other default gateway are dormant.
Hope my explanation is clear to the point. Please guide me is there any other industry practice to solve this case.
Thanks in advance
this is right from Cisco's ASA 8.0 config guide:
"Next Hop Selection Process
After selecting egress interface using any method described above, an additional route lookup is performed to find out suitable next hop(s) that belong to previously selected egress interface. If there are no routes in routing table that explicitly belong to selected interface, the packet is dropped with level 6 error message 110001 "no route to host", even if there is another route for a given destination network that belongs to different egress interface. If the route that belongs to selected egress interface is found, the packet is forwarded to corresponding next hop.
Load sharing on the security appliance is possible only for multiple next-hops available using single egress interface. Load sharing cannot share multiple egress interfaces."
"load sharing" is possible only for "multiple next-hops" on the "single egress interface"
two 0.0.0.0 routes to two next-hops on the same outside interface will load share.
unless there is a bug that TAC knows about. Did you try it and it didn't behave this way?
TAC might be talking about load balancing across two separate interfaces. You have one interface. Yes, if you have two outside interfaces, then one default is on standby using IP SLA
If this is really not possible, then turn your outside switch into L3 switch (hopefully it's at least 3550). Configure /30 between ASA and the L3 switch. Configure /30 between L3 switch and first router. Configure /30 between L3 switch and second router. Enable OSPF, RIP or EIGRP. Your ASA will see one dynamic 0.0.0.0 pointing to L3 switch, and L3 switch will load balance.