Ideally, you would place a router, connect two ISPs to it, reserve an autonomous system with public IP addresses and configure a fully redundant connection scheme with BGP protocol (Cisco ASA series support BGP only on 5500X models and with the latest versions of IOS). However, this approach suits only large companies with enough resources. For redundancy I got a second connection into my basement from a different ISP. I want to now configure my service to use the first ISP until it goes down and then automatically switch to the second ISP. I have installed a second NIC card into the server. However, I need some help in configuring the redundant set up I am after. Problem disappeared, it accepted the redundant VPN config and everything worked, (I flipped the circuit on this problem firewall this morning and downtime was less than 10 seconds). Related Articles, References, Credits, or External Links. Cisco ASA/PIX Redundant or Backup ISP Links with VPNs.

Cisco Asa Dual Isp Redundancy
Asa Isp Redundancy Tool
Asa Isp Redundancy Meaning

Status codes: s suppressed, d damped, h Here is a simple post about eBGP load balancing with single-homed BGP environment & two ISPIf user has two ISPs terminating on the ASA, the ASA is configured for ISP redundancy. I have that router, although I don't have two ISPs anymore. If the answer is no, then you need a secondary ISP at a minimum. I’m going to begin the config for ASAv-1 (left network) First let’s get some basic “optimizations” out of the way: The below allows the asa to keep track of ICMP and let it pass through (does it by IP and expected code reply).

This is article that explains how to configure dual ISPs on a Cisco ASA 5505 firewall for redundancy purpose. Suppose we have a primary high-speed ISP connection, and a cheaper DSL line connected to a Secondary ISP. Normally all of our traffic should flow through the high speed primary ISP. If the primary link fails, the secondary DSL connection should be utilized for Internet access. Please note that the above scenario is valid only for outbound traffic (i.e. from our internal network towards the Internet). The below configuration will works for ASA 5505 version 7.2(1) and above.

Now we assigned a static Public IP address of 150.150.150.2 from Primary ISP and another static Public IP address of 160.160.160.2 from our Backup ISP. We will use Ethernet 0/0 for connecting to Primary ISP, Ethernet 0/1 for connecting to our Internal LAN, and Ethernet 0/2 for connecting to our Backup ISP. We will create three VLANs to support our configuration. VLAN1 (the default Vlan) will be assigned to Ethernet 0/1 (inside), VLAN2 will be assigned to Ethernet 0/0 (primary-isp) and VLAN3 will be assigned to Ethernet 0/2 (backup-isp). We also have to configure two static default routes pointing to the ISP gateway address. The primary ISP default route shall have a metric of 1 and the backup ISP default route shall have a metric bigger than 1 (let’s say 2).

Let us see the configuration below:
ASA5505(config)# interface ethernet 0/0
ASA5505(config-if)# switchport access vlan 2
ASA5505(config-if)# no shutdown

ASA5505(config)# interface ethernet 0/1
ASA5505(config-if)# switchport access vlan 1
ASA5505(config-if)# no shutdown

ASA5505(config)# interface ethernet 0/2
ASA5505(config-if)# switchport access vlan 3
ASA5505(config-if)# no shutdown

ASA5505(config)# interface vlan 1
ASA5505(config-if)# nameif inside
ASA5505(config-if)# security-level 100
ASA5505(config-if)# ip address 172.16.1.1 255.255.255.0
ASA5505(config-if)# no shutdown

ASA5505(config)# interface vlan 2
ASA5505(config-if)# nameif primary-isp
ASA5505(config-if)# security-level 0
ASA5505(config-if)# ip address 150.150.150.2 255.255.255.0
ASA5505(config-if)# backup interface vlan 3
ASA5505(config-if)# no shutdown

ASA5505(config)# interface vlan 3
ASA5505(config-if)# nameif backup-isp
ASA5505(config-if)# security-level 1
ASA5505(config-if)# ip address 160.160.160.2 255.255.255.0
ASA5505(config-if)# no shutdown

ASA5505(config)# route primary-isp 0.0.0.0 0.0.0.0 150.150.150.1 1
ASA5505(config)# route backup-isp 0.0.0.0 0.0.0.0 160.160.160.1 2

Tutorial from https://www.ciscoconsole.com/

More Notes:

A Cisco user’s Dual ISP configuration issue of Cisco ASA from Cisco’s Support Community

I am trying to configure dual ISP on my ASA5505 (Security Plus license). I have everything configured and working when eth0/0 is connected, but when I disconnect it, it doesn’t route any traffic. The static route for the primary isp is removed and the static route to the backup isp shows up, but no traffic goes in or out. I should note that I’m doing this as a proof of concept so eth0/0 is connected to a router and eth0/1 is connected to another router.

Here is my show route output when eth0/0 is connected:

Gateway of last resort is 172.16.1.254 to network 0.0.0.0

C 172.16.1.0 255.255.255.0 is directly connected, primaryisp

C 192.168.5.0 255.255.255.0 is directly connected, inside

C 10.10.10.0 255.255.255.0 is directly connected, backupisp

S* 0.0.0.0 0.0.0.0 [1/0] via 172.16.1.254, primaryisp

Here is my show route output when eth0/0 is disconnected:

Gateway of last resort is 10.10.10.254 to network 0.0.0.0

C 192.168.5.0 255.255.255.0 is directly connected, inside

C 10.10.10.0 255.255.255.0 is directly connected, backupisp

S* 0.0.0.0 0.0.0.0 [10/0] via 10.10.10.254, backupisp

Cisco Asa Dual Isp Redundancy

Here is my config:

Asa Isp Redundancy Tool

…more details…

Asa Isp Redundancy Meaning

More Cisco Firewall Tips: