Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

failover ASA with 2 different outside interfaces

I would like to deploy the following and would like to know if it is feasible and advisable:

I would like to have 2 ASA's in failover mode with:

-one inside interface

-one DMZ interface

-TWO outside interfaces connected to two different ISP's (to the Internet), this is the part I am unsure about.

I have never seen or deployed such a setup before.

Some issues I thought of with this setup:

-port 25 from the Internet : what would the static NAT look like? Since there is only one DMZ, that is not an issue, but what would be the outside address of the static NAT? Or is there a need for 2 NAT's, one for each outside segment?

-routing : of the two circuits, one is a 10MG and one is a DSL, so the primary path should be the 10MG and backup is the DSL, should HSRP be setup on the firewall?

Please see attachment for the details


Re: failover ASA with 2 different outside interfaces

With 7.2(1) or later they added the ability to track routes which is what you'll need for your setup. I assume your running Active/Standby, if not please advise as it changes everything.

Remember this works with no issues for outbound and return traffic, If your hosting services like mail make sure you setup all your DNS with the backup IP's or those services won't work on the backup.

This link should provide your solution.

There is a bug in with route tracking and failover. See bug report and make sure your running a ver that has been fixed.

There are other ways of doing this but are more involved to setup. Like using 1 outside interface and running HSRP on your edge routers and having each ISP agree to advertise your other ISP block. Or doing NAT again out your backup ISP but can cause issues depending out what services your running.



Please rate if helpful!

CreatePlease to create content