4

I have two ISP connections on two Cisco 2901 routers, in front of Cisco ASA-5515 firewall. I need to configure failover load balancing network.

  • Two Cisco 2901 router with dual (different ISP) connections.

  • One Cisco ASA 5515 firewall behind Cisco 2901 routers.

Please suggest me how to design the network, and then configure routers and firewall. A sample network diagram is attached below. I don't know if this is the correct way, please advise me.

enter image description here

  • OP, Which option did you use? Please share your experience. Thank you. – user31151 Oct 10 '16 at 13:26
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Aug 7 '17 at 1:24
2

You could configure a floating static route. This is a method in which two default routes are configured one with a higher AD than the other so that when one link goes down the route would be removed and the backup inserted to take over. For this to work the 2901's would have to be plugged directly into the firewall to detect the link is down and therefor remove the primary route from the routing table.

route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
route outsidebackup 0.0.0.0 0.0.0.0 192.168.2.1 2

P.S. In the question you say you use a 5505 and a 5515, which one is it? The only reason I ask is that the 5505 can have some limitations when it comes to named interfaces.

| improve this answer | |
  • sorry for the confussion. using 5515. can i configure load balancing ? – sareeshmnair Jul 6 '15 at 14:46
2

Note: Previously Mentioned "Floating Static Route" Yes, as described this will work. However, what if the connection between the routers and the ISP goes down? The ASA would not know about this and thus traffic would be dropped at that router. Further, what if the ISP is having an internal issue and the router, the links and even the routers next hop to the internet stay up? Again, the ASA would not know about this and traffic would then be dropped at that router. I would advise you steer away from this solution in a production network. Please do not take offense to this, just wanted to provide some feedback.


Missing Information:

  1. Where will NAT be performed?
  2. Curious why you are using routers and not connecting each ISP into the ASA directly
  3. Plans to run BGP with your ISP

Option 1: ASA Handles Failover (IP SLA and Floating Static Route)

The below config sets up IP SLA to ping 8.8.8.8. Then we start the sla monitor and set it to run forever. Then we verify (show commands) that the status shows OK and config looks correct. If status is OK, then we add the floating static routes (like previously mentioned) but we add a track on this such that when we can no longer ping 8.8.8.8, the static route comes out and the only remaining default route is the route to the second router. The below config assumes that your nameif for ISP1 is outside and your nameif for ISP2 is backup. You must replace x.x.x.x and y.y.y.y with the next-hop IP for the router. I'm also assuming you want to run dynamic NAT off the ASA's interface that faces the routers. ASA Config:

sla monitor 99
 type echo protocol ipIcmpEcho 8.8.8.8 interface outside
 num-packets 3
 frequency 10
!
sla monitor schedule 99 life forever start-time now
!
track 99 rtr 99 reachability
!
show run sla monitor
!
show run track
!
show sla monitor operational-state 99 | include operation
!
show sla monitor operational-state 99
!
route outside 0.0.0.0 0.0.0.0 x.x.x.x 1 track 99
route backup 0.0.0.0 0.0.0.0 y.y.y.y 254
!
object network isp1-nat
 subnet a.b.c.0 255.255.255.0
 nat (inside,outside) dynamic interface
!
object network isp2-nat
 subnet a.b.c.0 255.255.255.0
 nat (inside,backup) dynamic interface
!

Option 2: HSRP and a Switch

Let's say you are not going to NAT on the ASA or you could NAT on the ASA and on the router. I'd suggest picking one place closest to the "inside" network you want to translate (NAT).

Connect the Routers inside interface and just the "outside" interface of the ASA into a switch, place each of these ports into their own VLAN. Configure HSRP on the routers and point the ASA's default route to the HSRP VIP. NOTE: GLBP load balancing (round robin) will not work here as the source MAC address will not change, thus you'll be locked to one of the routers all the time. VRRP is also acceptable here, whichever one you feel comfortable with. Use "Track" with HSRP to track the interface BUT also setup IP SLA, like we did on the ASA on the primary router connected to the primary ISP. I would also suggest, adjusting HSRP timeouts and setting an HSRP password for added security.

Learn more: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp/configuration/15-s/iap-15-s-book/iap-eot.html

Sample Config:

router1:
interface gi0/0
 description outside
 ip address x.x.x.x x.x.x.x
 ip nat outside
 no shutdown
!
ip sla 99
 icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0
 request-data-size 1
 tos 160
 timeout 2000
 threshold 2000
 frequency 15
 hours-of-statistics-kept 8
!
ip sla schedule 99 life forever start-time now
!
track 99 ip sla 99 reachability
 delay down 40
!
interface gi0/1
 description inside HSRP VIP: a.b.c.1
 ip address a.b.c.11 255.255.255.0
 standby 1 ip a.b.c.1
 standby 1 preempt
 standby 1 priority 105
 standby 1 track 99
 ip nat inside
!
ip access-list standard NAT
 permit a.b.c.0 0.0.0.255
!
ip nat inside source list NAT interface gi0/0 overload


router2:
interface gi0/0
 description outside
 ip address x.x.x.x x.x.x.x
 ip nat outside
 no shutdown
!
interface gi0/1
 description inside HSRP VIP: a.b.c.1
 ip address a.b.c.12 255.255.255.0
 standby 1 ip a.b.c.1
 ip nat inside
 no shutdown
!
ip access-list standard NAT
 permit a.b.c.0 0.0.0.255
!
ip nat inside source list NAT interface gi0/0 overload


ASA config:
route outside 0.0.0.0 0.0.0.0 a.b.c.1 1
!

Option 3: Dynamic Routing Foo

Everybody has their reasons for not to do this, but this is still an option. Although you could run other routing protocols, running EIGRP would be an acceptable solution here I think. You could connect the 2 routers and the ASA to a switch and place them in their own VLAN. Then you could fire up EIGRP, advertise a default route from both routers to the ASA and you'll have redundant paths (load balancing). However load balancing in this scenario may yield undesirable results, so just adjust the metric (Bandwidth or Delay) on the ISP2 router and voila. I'm not going to write up a config for this as it is pretty straightforward to do.


Closing: I do not believe there is one right answer, however there are options to accomplish the task you desire. I would look at the options and weigh the pro's and con's. Besides you can always revert your changes and tweak things to get them working the way you want. I would also suggest taking a look at hardening those routers. This guide is old but has helped me many times in the past. You may have to translate some commands over to newer version of IOS but still good reading here: http://www.sans.org/reading-room/whitepapers/firewalls/cisco-router-hardening-step-by-step-794

Happy Networking to you!

| improve this answer | |
  • This scenario is for one of our client. I am very new to networking (Only theory knowledge and few working experience). I need to design and configure this. I assume that NAT will perform in routers (Is that good ?). – sareeshmnair Jul 8 '15 at 9:16
  • Ok. Would you be able to obtain a second ASA5515x and could you have the Security Plus license installed? – Joseph Drane Jul 8 '15 at 16:17
  • If so, I suggest this: 1.) Remove the routers from the topology 2.) Connect each ISP link and two links from each ASA to a switch. 3.) Place each ISP link and the 1 link from each ASA in the same VLAN on the switch. Repeat this for the other ISP using a different physical switch. The switches will need to be trunked together or stacked. 4.) Place the ASA's into a HA pair (active,standby) pair. connecting a physical cable between the ASA's. 5.) Follow my previous instructions, keeping NAT on the ASA's. – Joseph Drane Jul 8 '15 at 16:24
0

The load balancing can be done via subnet or vlan or any criteria that you can think of with an ACL, provided your switch is a layer 3 switch. Simply match the traffic and apply a route map to policy route said traffic thru 2901 corresponding to ISP1, and ISP2 respectively.

If switch is layer 2 only, move the firewall to the other side of the 2901's and have the 2901 be the default gateway per VLAN/subnet. You can then load balance ISP per VLAN.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.