topic Re: 2 ISPs redundancy problem in Network Security

2 ISPs redundancy problem (SOLVED)

leoandino — Fri, 21 Feb 2020 14:51:48 GMT

Hi.

I have an ASA 5508-x connected to two ISPs. I made the relevant configurations of the static route with superior metric of SLA monitor, Track ID and the IP tracking address 8.8.8.8.

When I did the backup tests of ISPs, they worked fine by disconnecting the network cable from the ASA to the primary ISP router. But in the primary ISP, when simulating a fiber optic interruption, the ISP backup does not work. The ASA is not able to detect that the primary ISP internet is failing.

I assume because while the ASA does not detect that the interface directly connected to the primary ISP router is down, it will not remove its static route from the route table.

Is there any way to do it? What am I setting wrong?

Thank you.

SOLVED:

Solved.
Both links are enabled on its interface by DHCP. Once the ip address was added manually, the problem was solved. 🙂
Thank you !!!

Re: 2 ISPs redundancy problem

Flavio Miranda — Wed, 29 Nov 2017 12:41:56 GMT

Hi @leoandino

How did you configured the sla monitor on ASA. It should validate by using icmp and if interface is down, means ping will fail, this should work.

Can you share the config?

-If I helped you somehow, please, rate it as useful.-

Re: 2 ISPs redundancy problem

leoandino — Wed, 29 Nov 2017 12:47:15 GMT

Hi.

Thank you for request.

sla monitor 1

type echo protocol ipIcmpEcho 8.8.8.8 interface outside_GTD

num-packets 3

frequency 10

sla monitor schedule 1 life forever start-time now

track 1 rtr 1 reachability

route outside_GTD 0.0.0.0 0.0.0.0 190.34.x.x 1 track 1

route Outside_Entel 0.0.0.0 0.0.0.0 192.168.100.1 2

Re: 2 ISPs redundancy problem

Flavio Miranda — Wed, 29 Nov 2017 13:03:42 GMT

Looks fine and as expected reachability should be the trigger and not interface status.

I recommend you to run "debug sla monitor trace " "debug sla monitor error " and repeat the test.

-If I helped you somehow, please, rate it as useful.-

Re: 2 ISPs redundancy problem

leoandino — Wed, 29 Nov 2017 13:31:52 GMT

Hi..

How can I filter that debug in the handle? When you enable the logging monitor debuggin it is impossible to visualize.

Re: 2 ISPs redundancy problem

Flavio Miranda — Wed, 29 Nov 2017 13:35:19 GMT

Does not filter. Send it to a txt file. As much information is better.

-If I helped you somehow, please, rate it as useful.-

Re: 2 ISPs redundancy problem

leoandino — Wed, 29 Nov 2017 13:55:54 GMT

Hello,

Attached TXT file.

Re: 2 ISPs redundancy problem

Flavio Miranda — Wed, 29 Nov 2017 15:27:13 GMT

Unfortunately have no SLA log on the file.

Logs should look like:

IP SLA Monitor(123) Scheduler: Starting an operation
IP SLA Monitor(123) echo operation: Sending an echo operation
IP SLA Monitor(123) echo operation: RTT=0 OK
IP SLA Monitor(123) echo operation: RTT=0 OK
IP SLA Monitor(123) echo operation: RTT=1 OK
IP SLA Monitor(123) Scheduler: Updating result

-If I helped you somehow, please, rate it as useful.-

Re: 2 ISPs redundancy problem

leoandino — Wed, 29 Nov 2017 16:23:02 GMT

hi,

unfortunately I have no experience in ASA to capture the debug. Apply the mentioned commands, but I do not know why it is not displayed. 😞

Re: 2 ISPs redundancy problem

Flavio Miranda — Wed, 29 Nov 2017 18:29:27 GMT

Looks like the logging console is set to 7 on your firewall.

Try "no logging console" command and then run the debug again.

Then try logging debug-trace

-If I helped you somehow, please, rate it as useful.-

Re: 2 ISPs redundancy problem (SOLVED)

leoandino — Thu, 07 Dec 2017 15:29:08 GMT

Solved.
Both links are enabled on its interface by DHCP. Once the ip address was added manually, the problem was solved. 🙂
Thank you !!!