I'm going to be more explicit about this and hope you'll get me through

I have two ISPs connected each one to a cisco ASA 5510.the two ASA are connected to a cisco switch 3650 that connects my LAN. I want then my lan users to automatically change the link to the internet when the primary ASA can't get them to the internet, means when they don't have access to the internet by the time the primay ISP is down. Hope this is clear to get you help me out.

Thanks and best regards

  • 1
    What is your question? What is your current configuration and what is not working exactly?
    – hertitu
    Commented Apr 1, 2018 at 22:19
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Commented Jan 7, 2021 at 0:56

2 Answers 2


Cisco has a good document that describes your exact scenario:

Configure the ASA for Redundant or Backup ISP Links

This document describes how to configure the Cisco ASA 5500 Series Adaptive Security Appliance (ASA) for the use of the static route tracking feature in order to enable the device to use redundant or backup Internet connections.

  • This document describes how to configure a single ASA with dual ISP links, the OP has 2 ASA with 1 ISP each.
    – hertitu
    Commented Apr 1, 2018 at 22:24

Recap: So, you have two separate firewalls, each with an internet connection. You want users to go to the primary firewall and use the primary ISP unless it's down, in which case you want users to go to the second firewall and use the second ISP. Is that right?

The only way I can think of to do what you're asking for involves the use of a layer 3 core switch. You would configure a floating static route (a static route with a terrible administrative distance) that points to the backup ASA. You then would establish a dynamic routing protocol between the primary ASA and the core switch. Maybe OSPF or EIGRP. Then, you would configure IP SLA on the primary firewall to track an IP address out on the internet, and inject a default route into OSPF or EIGRP when the internet is up. This dynamic route will be more preferred than the static route.

This will cause your core switch to always send traffic to the primary ASA and out to the internet. If the primary ISP goes down, then the tracked IP address fails, and the default route is removed from OSPF or EIGRP. Then, the core switch installs the less-preferred static route that points at the second ASA. Then, users would go out the second ISP.

But to be honest, you should not do this. Nearly anything that two ASAs can do, can also be done with just one ASA. If I were in your shoes, I'd put both internet circuits into one ASA and follow the doc that Ron posted. Then, I'd take the second ASA and make it a failover mate (if the hardware is identical) with the primary firewall. Then you won't need OSPF or EIGRP, and you'll have internet redundancy that is independent of your hardware redundancy!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.