Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Multiple ISP and ASA


Can any one suggest me how to configure load-balancing and failover between ASA and multiple ISPs. All ISP connections is terminated on a single router.

Thanks and regards,


New Member

Re: Multiple ISP and ASA

If you find that out, let us know. Right now I am moving to Linux+iproute2

New Member

Re: Multiple ISP and ASA

Well as far as I know you can do that well on a router but on the asa/pix you can set the multiple static routes with the same metric/cost.

This will not work as well as on the router but you know hehehe its a firewall not a router :)

Please guys read

If you find it interesting please rate :)

Re: Multiple ISP and ASA

Hi SH.

You can achieve this goal on the router. Are you using multiple ISPs terminating on the same router?

IMHO: For best way you can use load-sharing mechanism with policy base routing feature on the router. Let me explain further you can give vlan/subnet 2-5 go to ISP_1 and vlan/subnet 6-10 go to ISP_2 with source-route of policy base routing feature. Now you can control out-bound traffics go to ISPs. I don't think multiple default route will be good solution for multiple ISPs because are you sure the packets of 1 session go to the same ISP at a time.

Hope this helps


New Member

Re: Multiple ISP and ASA

No doubt you need a router but that's why you use these command

ip load-sharing per-packet


ip load-sharing per-destination

Re: Multiple ISP and ASA

The process is simple ( If there is 1 DMZ )-

The PIX / ASA can handle only 1 outside route.

Therefore this route has to be your Internet router's Ethernet Address.

On the internet router put 1 default outside route towards ISP1 ( the ISP on which the DMZ is hosted )

Then put 1 Route-map on the Ethernet Interface of the router which is on the same subnet as the PIX outside.

This routemap will define that if a particular traffic has to be sent to ISP B, match that with an ACL ( this will be the public IP of ISP B ) with the source IP of the subnet which has to be routed via ISP B.

Set the next hop as the WAN interface of ISP B

You are done.

New Member

Re: Multiple ISP and ASA

So guys, is it advicable not to NAT at the firewall and do the NATting at the router and use the appropriate switching method on the router to route traffic.

This is what I think you are trying to suggest for this problem.

Thanks and regards,


Re: Multiple ISP and ASA


The NAT should be done on the firewall.

example -

On the firewall NAT outside IP of ISP A ( ) NAT outside IP of ISP B


On the internet router

put default route to WAN IP of ISP A

put policy route for packet originating with source IP - next hop WAN IP of ISP B

New Member

Re: Multiple ISP and ASA

Hi Anand,

What about the load-balancing and the failover in this case?

T & r,


Re: Multiple ISP and ASA

Loadbalancing will happen based on Subnets.

*** Loadbalancing ***

Say internal subnet A - will be routed via Link A

( Using the Default route & NAT for Link A )

internal subnet B - will be routed via Link B

( Using the Policy Route & NAT for Link B )

*** For Failover *** - YOu have to do the following & it is manual :(

(Since you are not running BGP config where

both ISPs can route each other's traffic )

Summary -

Change route & Change NAT. May be a little confusing.

Details -

If Link A goes down - Change default route on the internet router to Link B

Change the NAT config for Subnet A & add the it to pool B

If Link B goes down - Remove the Policy route from the Internet router so that all traffic is diverted to the Link A

Change the NAT config for Subnet B & add the it to pool A

Let me know if you have any doubts

HTH - Please rate all useful posts