Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I'm going to be more explicit about this and hope you'll get me through
I have two ISPs connected each one to a cisco ASA 5510.the two ASA are connected to a cisco switch 3650 that connects my LAN. I want then my lan users to automatically change the link to the internet when the primary ASA can't get them to the internet, means when they don't have access to the internet by the time the primay ISP is down. Hope this is clear to get you help me out.
Thanks and best regards
Cisco has a good document that describes your exact scenario:
Configure the ASA for Redundant or Backup ISP Links
This document describes how to configure the Cisco ASA 5500 Series Adaptive Security Appliance (ASA) for the use of the static route tracking feature in order to enable the device to use redundant or backup Internet connections.
Recap: So, you have two separate firewalls, each with an internet connection. You want users to go to the primary firewall and use the primary ISP unless it's down, in which case you want users to go to the second firewall and use the second ISP. Is that right?
The only way I can think of to do what you're asking for involves the use of a layer 3 core switch. You would configure a floating static route (a static route with a terrible administrative distance) that points to the backup ASA. You then would establish a dynamic routing protocol between the primary ASA and the core switch. Maybe OSPF or EIGRP. Then, you would configure IP SLA on the primary firewall to track an IP address out on the internet, and inject a default route into OSPF or EIGRP when the internet is up. This dynamic route will be more preferred than the static route.
This will cause your core switch to always send traffic to the primary ASA and out to the internet. If the primary ISP goes down, then the tracked IP address fails, and the default route is removed from OSPF or EIGRP. Then, the core switch installs the less-preferred static route that points at the second ASA. Then, users would go out the second ISP.
But to be honest, you should not do this. Nearly anything that two ASAs can do, can also be done with just one ASA. If I were in your shoes, I'd put both internet circuits into one ASA and follow the doc that Ron posted. Then, I'd take the second ASA and make it a failover mate (if the hardware is identical) with the primary firewall. Then you won't need OSPF or EIGRP, and you'll have internet redundancy that is independent of your hardware redundancy!
