Mechanism of failover when having 2 ISP Links

[haithamnofal]

Hi There,

I'm planning to have 2 internet link from 2 different ISPs on my perimter router; the perimter ASA FW is configured to do NATing according to the public range I got from the current ISP. When I receive the 2nd public from the 2nd ISP, how should the configuration on my ASA look like and how will it AUTOMATICALLY transfer the NATing to use the address range from the 2nd ISP?

Example: the range from ISP1 is x.x.x.1-7 whileas, the range from ISP2 is y.y.y.1-7; currently the ASA is using the x.x.x.1-7 to do NATing, now if this link failed how can the ASA start using the y.y.y.1-7 range with no need for manual change?

Appreciate your feedback.

Thanks,

Haitham

[Richard Burts]

Haitham

How would your ASA FW know which ISP the perimeter router would be using? Unless it can know that I do not see that the solution can be implemented on the ASA FW.

What about configuring the perimeter router so that if it received traffic from the ASA FW with address x.x.x.n and is going to forward the traffic to the other ISP that it does a translation of address from x.x.x.n to y.y.y.n?

HTH

Rick

[haithamnofal]

Rick,

Can OSPF help the ASA in detecting the failure of the 1st ISP link?

Regards,

Haitham

[Richard Burts]

Haitham

Do you think that you would be able to run OSPF over both links to ISPs? Without that I doubt that OSPF would solve your problem.

HTH

Rick

[srue]

you might need to advertise your address ranges to both ISP's via bgp...if you can do that, it doesn't matter which isp assigned which range of addresses. if bgp is not an option, you can always NAT at the router instead of the ASA device...

[m-haddad]

Well, what you can do without dynamic routing is to use something called SLA routing where the ASA will ping the ISP next hop and when the first ISP goes down it routes to the second. However, you still have the public IP problem.

Please let me know if you need further explanantion,

Regards,