Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

asa 5505 dual ISP Failover rtr "hangs" on Primary ISP with reboot

Got an Asa 5305 running 8.22.  It is setup for a dual ISP failover using RTR, taken from the Cisco link

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml#debug

===

sla monitor 123

type echo protocol ipIcmpEcho 5x.12x.228.1 interface outside

num-packets 3

frequency 10

sla monitor schedule 123 life forever start-time now

route outside 0.0.0.0 0.0.0.0 10x.2xx.47.129 1 track 1

route backup 0.0.0.0 0.0.0.0 9x.6x.8.10x  254

====

The device has two IPSEC tunnels setup for each external IP of "outside" and "Backup".

If we fail the outside ISP, we have successful failover to "backup" ISP.

SOMETIMES, the return to the primary ISP "outside" does not work properly. The OUTSIDE interface will become primary, but the IPSEC tunnel will not come up.  Doing a "shut" on the ASA's e0/0 interface will fix this.

Anyone seen this weird behaviour before? once the shut/no shut on e0/0, the Ipsec tunnel will come up.

Did I miss something with the RTR ans SLA commands?

Thanks

Everyone's tags (7)
1 REPLY
Cisco Employee

asa 5505 dual ISP Failover rtr "hangs" on Primary ISP with reboo

Hello,

It would be a good idea to upgrade past the fix for this bug:

CSCsz04730 - PIX/ASA: When route changes connections over IPSEC tunnel not torn down

It is fixed in 8.2.5.20 and higher.

-Mike

962
Views
0
Helpful
1
Replies
CreatePlease to create content