I am setting up a highly redundant network and want to run my two ASA's in failover mode - each with a link to a router connected to two different ISP's.
The topology:
My two 2911's are running BGP to the ISPs, and the ASAs are configured in active/passive failover mode.
But how do I configure the links from the ASAs to the routers? They are on 2 different subnets at the moment.
Assuming a single context active/passive failover configuration with the ASAs connecting to the 2911s on unique subnets, you could trunk the links using two subinterfaces and vlan tagging. But the hack is to not have both subinterfaces active at the same time on a single ASA. On the ASA on the left assuming it's active, the first subint would be alive and the second down. After a failover event, the ASA on the right becomes active, and the first subint goes down and the second subint comes up.
Ideally, the ASAs share a common subnet with the LAN side of the 2911s precluding this hack; a L2 switch can sit between the ASAs and provide connectivity from any ASA to any 2911.
Only the relevant subinterfaces' config shown.
ASA
interface GigabitEthernet0/0 no nameif no security-level no ip address ! interface GigabitEthernet0/0.10 vlan 10 nameif Outside-ISP1 security-level 0 ip address 1.1.1.254 255.255.255.0 ! interface GigabitEthernet0/0.11 vlan 11 nameif Outside-ISP2 security-level 0 ip address 2.1.1.254 255.255.255.0 route Outside-ISP1 0.0.0.0 0.0.0.0 1.1.1.1 1 route Outside-ISP2 0.0.0.0 0.0.0.0 2.1.1.2 1
2911-ISP1
interface GigabitEthernet0/1 description LAN no ip address duplex auto speed auto ! interface GigabitEthernet0/1.10 description LAN-ISP1 encapsulation dot1Q 10 ip vrf forwarding vpn ip address 1.1.1.1 255.255.255.0 ! interface GigabitEthernet0/1.11 description LAN-ISP2 encapsulation dot1Q 11 ip address 2.1.1.1 255.255.255.0 shutdown
2911-ISP2
interface GigabitEthernet0/1 description LAN no ip address duplex auto speed auto ! interface GigabitEthernet0/1.10 description LAN-ISP1 encapsulation dot1Q 10 ip address 1.1.1.2 255.255.255.0 shutdown ! interface GigabitEthernet0/1.11 description LAN-ISP2 encapsulation dot1Q 11 ip address 2.1.1.2 255.255.255.0
The current answer provides you with a good solution. However, I would advise against using a single switch to connect all of these devices. If you do this you end up with an additional failure domain with a single point of failure. I see two options here:
Use a switch stack to implement this recommendation. (Eliminates the single point of failure)
Directly connect links from each 2911 to each ASA. (Depends on port utilization)
I would also recommend enabling an IGP such as OSPF or EIGRP between your 2911 and ASA devices. If you are going to use static routes make sure that you implement the appropriate tracking configuration. The switch/es would mask link down thus preventing the route from being removed on the ASA. You could also implement HSRP on the 2911 routers and point the ASA 0.0.0.0/0 to the HSRP address.
you cannot put 2 default route on ASA
ciscoasa(config)# route Outside-ISP1 0.0.0.0 0.0.0.0 1.1.1.1
ciscoasa(config)#
ciscoasa(config)#
ciscoasa(config)# route Outside-ISP2 0.0.0.0 0.0.0.0 2.1.1.2
ERROR: Cannot add route entry, conflict with existing routes
you can use 1 default and and others specific rote to other isp
