enter image description here

hello everyone attached is my diagram in which i am facing problem as you can see i have two internet links from two ISPs in which i want failover between two ISPs without using BGP or NAT because i am also going to configure Site-to-Site VPN over the two ASA which also needs to be in failover for each other can anyone please give an opinion regarding this problem

  • So you only want outbound failover because BGP is required for inbound failover? Please clarify any dynamic routing protocols running between the ASAs and the 6500s. – generalnetworkerror Apr 12 '15 at 6:46
  • actually this scenario could be done with BGP easily but in here i am not going with BGP i want like this if my first ISP is down i have to be connected with my outside customers through the second ISP since i am also configuring VPN in the ASA the at the time when ISP 1 is down i don't have to reestablish a new VPN tunnel with my customers. between the two 6500s i am thinking of VSS and the routing protocol that will be used will be EIGRP – Networker Apr 12 '15 at 7:57
  • Your diagram isn't workable. The outside interfaces of the firewalls need to be connected together (on the same subnet). Also do you have your own registered IP space? As @generalnetworkerror says, you can only control the outbound path. – Ron Trunk Apr 12 '15 at 11:11
  • if the diagram is not workable what is your suggestions to make it workable i can take my own registered IP space but the problem will be that i can not broadcast those IP address through BGP(not Supported by the ISP). and even if i get my own Range Of IP address the IPs will be terminated in routers and so i can't NAT those IP address because the VPNs will be created on the ASA for which i will need Public IPs in order to make VPN tunnel – Networker Apr 13 '15 at 4:44
  • If you can't use BGP, then you can't influence the inbound path. That pretty much stops you right there. You can't tell ISP 1 that you've lost connectivity and they should stop forwarding traffic to you. You need some way of communicating your status to the ISPs, which is the whole purpose of a routing protocol. I'm surprised that neither ISP will peer with you. – Ron Trunk Apr 13 '15 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.