5

Let's assume there are two firewalls (ASA) clustered together and two routers (1800 and 2900) each with it's own WAN link. The two routers are managed from the same ISP (it's just link redundancy).

Below is my setup.

  ASA    ASA
   |\    /|   
   | \  / |
   |  \/  |
   |  /\  |
   | /  \ |
   |/    \|
   R1    R2 
   |      |
(Cloud) (Cloud)

Is it possible to have the redundant WAN connection take over in case of a failure? If so, how?

Improve this question
6
  • Are you just trying to use the backup in case of a failure or load balance across them?
    – Ryan Foley
    Feb 21, 2014 at 14:42
  • Yes just in case of failure.
    – radtrentasei
    Feb 21, 2014 at 14:47
  • What routing protocol are you using?
    – Ryan Foley
    Feb 21, 2014 at 20:41
  • My setup is different from the one in the "picture". Right now we have a switch that is used, mostly, as backend for the firewalls. Unfortunately the routers (both of them) are connected with one switch over a certain VLAN. That VLAN represents a public /28 network. Both the ASA and the routers have HSRP addresses in that net (waisting public space). So finally on the ASA is configured a default route with next hop the active IP of the routers and, i guess, the routers see the public net has directly connected. This is my conf, I hope it's clear.
    – radtrentasei
    Feb 23, 2014 at 14:37
  • How is routing accomplished on your network? Or are you using static routes? How are your default gateways distributed?
    – Ryan Foley
    Feb 23, 2014 at 15:17

2 Answers 2

Reset to default
2

Here is a high level view of one solution:

Connect the LAN side of the routers and the outside of the ASA in a single VLAN. You will need an additional switch if your routers do not have multiple Ethernet ports.

Configure HSRP on your routers, and make the VIP address the default gateway of the ASAs. The router's static route to the inside is the ASA primary address.

Configure HSRP to track the interface of each WAN link. So if the WAN link goes down, the HSRP priority is reduced, causing the other router to become the active peer. In this way, only the router with an "up" WAN link will be the HSRP active router.

If you want to get fancy, you can set up IP SLA to ping the ISP to verify reachability, not just interface status, and let HSRP track that. Or, you can run BGP with your provider (default route only) to verify reachability.

Let me know which way you want to go, and I can come up with some sample configs if needed.

Improve this answer
6
  • Perhaps an IP SLA attached to a static route would be the most efficient without changing his setup.
    – Ryan Foley
    Feb 21, 2014 at 16:41
  • To have all the devices on the same VLAN without a switch do I have to switchport all the interfaces, and than configure interface VLANs,it is right?
    – radtrentasei
    Feb 21, 2014 at 16:45
  • Yes. You can use whatever VLAN you like (1 is fine).
    – Ron Trunk
    Feb 21, 2014 at 16:56
  • Won't be dynamic routing an option ?
    – radtrentasei
    Feb 21, 2014 at 19:25
  • It's an option. There's more than one solution to this. It's up to you which you find easier to configure and maintain. You can configure OSPF on the ASA and your routers, but you still need to either redistribute your BGP default route into it, or use IP SLA to control advertisements. Either way, you need some mechanism to tell you when you've lost connectivity on one of your WAN links.
    – Ron Trunk
    Feb 21, 2014 at 20:08
2

I'll piggy-back what Ron said; HSRP with an IP SLA is the way to go. This will allow you to fallback on your alternate ISP if your primary link goes down.

Here's a reference to work off of.

R1

ip sla monitor 1
 type echo protocol ipIcmpEcho 1.1.1.1
 timeout 1000
 frequency 3
!
ip sla monitor schedule 1 life forever start-time now
!
track 1 rtr 1
!
interface FastEthernet1/0
 ip address 10.1.1.1 255.255.255.0
 standby ip 10.1.1.254
 standby priority 120
 standby preempt
 standby track 1 decrement 40

R2

ip sla monitor 1
 type echo protocol ipIcmpEcho 2.2.2.2
 timeout 1000
 frequency 3
!
ip sla monitor schedule 1 life forever start-time now
!
track 1 rtr 1
!
interface FastEthernet1/0
 ip address 10.1.1.2 255.255.255.0
 standby ip 10.1.1.254
 standby priority 100
 standby preempt
 standby track 1 decrement 40
Improve this answer
2
  • I guess that when you refer to 1.1.1.1 and 2.2.2.2 you mean any public pingable and "always on" IP address. By the way I do not own the routers, therefore I think I should replicate this conf on the ASA.
    – radtrentasei
    Feb 24, 2014 at 8:30
  • @radicetrentasei 1.1.1.1 and 2.2.2.2 are the addresses you are trying to ensure are always on. If you don't control the Routers, then you would do that on your ASAs.
    – Ryan Foley
    Feb 24, 2014 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.