Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

asa 5505 dual ISP Failover rtr "hangs" on Primary ISP with reboot

Got an Asa 5305 running 8.22.  It is setup for a dual ISP failover using RTR, taken from the Cisco link


sla monitor 123

type echo protocol ipIcmpEcho 5x.12x.228.1 interface outside

num-packets 3

frequency 10

sla monitor schedule 123 life forever start-time now

route outside 10x.2xx.47.129 1 track 1

route backup 9x.6x.8.10x  254


The device has two IPSEC tunnels setup for each external IP of "outside" and "Backup".

If we fail the outside ISP, we have successful failover to "backup" ISP.

SOMETIMES, the return to the primary ISP "outside" does not work properly. The OUTSIDE interface will become primary, but the IPSEC tunnel will not come up.  Doing a "shut" on the ASA's e0/0 interface will fix this.

Anyone seen this weird behaviour before? once the shut/no shut on e0/0, the Ipsec tunnel will come up.

Did I miss something with the RTR ans SLA commands?


Everyone's tags (7)
Cisco Employee

asa 5505 dual ISP Failover rtr "hangs" on Primary ISP with reboo


It would be a good idea to upgrade past the fix for this bug:

CSCsz04730 - PIX/ASA: When route changes connections over IPSEC tunnel not torn down

It is fixed in and higher.


CreatePlease to create content