I have 2 new 100Mbps fiber links to a single ISP. THey are terminated on two Cisco IOS routers with BGP configured as described in Cisco document ID #13762, per the "Load sharing when dual-homed to one ISP through multiple local routers" section. That is all working as expected.
This new fully redundant connection is for a failover pair of ASA 5520s that will be terminating a large number of VPNs.
Because BGP "load shares" as opposed to round-robin, per-packet "load balancing", I planned to have two outside interfaces configured on the ASA. One for the 192.168.11.0 primary network (see the diagram in the the Cisco doc above) and one on the 192.168.12.0 secondary net. Then I'd point half of my remote VPN routers point to a 192.168.11.x peer address and the other half at the ASA's 192.168.12.x address. This would allow BGP to distribute the traffic from the remotes across the two links based on destination address.
Unfortunately, The ASA does not allow me to configure a default route for each of the two public interfaces. I get a default route in for one interface just fine but it won't accept another (equal cost) route for the other interface. According to ASA config guides this is the way it's supposed to be.
How can I terminate VPNs on two interfaces of the ASA and get the traffic distributed across both links, preferably by source address?
Route maps on the ASA only function for redistribution of routes via dynamic routing protocols so a simple route map can't be used. SInce my two "local" subnets are contiguous, I considered deliberately mis-configuring the ASA public interfaces' subnet masks (there really /26 each and I' make them /25) and let the "ip proxy-arp" on the routers try to sort it out, but I doubt the ASA will allow two interfaces to be configured on the same subnet.
Do I need to enable OSPF on the ASA and the Internet routers and let the routers re-distribute default routes to the ASAs? I'm not sure how the overlaid primary and secondary subnets would affect the OSPF multicast packets.