topic Re: ASA Active standby with dual ISP terminated on two different route in Network Security

ASA Active standby with dual ISP terminated on two different router

sajid231088 — Mon, 06 Feb 2023 14:03:28 GMT

Hi Experts,

Hope you all are doing well.

please help me in below.

We have two ASA configured in Active/Standby, at present we have single ISP but we are going to have second ISP soon.

new topology would be :

ISP RTR1 -----> ASA1 ------> Core SW1

ISP RTR 2 ----> ASA2 ------> Core SW2

need to know, can i directly connect ISP link with ASA or do i need any Switch in between

If, any switch required what would be switch and ASA configuration OR if switch not required then what would be a ASA(both ASA) configuration.

Thanks,

Re: ASA Active standby with dual ISP terminated on two different route

Karsten Iwen — Mon, 06 Feb 2023 14:15:07 GMT

It is very likely that you need an additional switch. Both outside interfaces of both ASAs need to see each other. For Example:

outside1 of ASA1 and ASA2 connect to ISP1
outside2 of ASA1 and ASA2 connect to ISP2

If the ISP device has two ports you can connect both ASAs to it. But it is quite common that the ISP device only has one port. Here you need a switch to connect both ASAs to the ISP router.

Re: ASA Active standby with dual ISP terminated on two different route

Rob Ingram — Mon, 06 Feb 2023 14:15:39 GMT

@sajid231088 you should connect the ASA outside interfaces into a switch, in the same vlan as an isp router. That way both ASA can communicate to the isp router.

Re: ASA Active standby with dual ISP terminated on two different route

Kasun Bandara — Mon, 06 Feb 2023 14:15:41 GMT

if your ISP gives 2 lines for same connection you can connect that to two ASAs. or use switch between ASAs and ISP router. then connect ISP to switch and 2 cables from switch to 2 ASAs

Re: ASA Active standby with dual ISP terminated on two different route

sajid231088 — Mon, 06 Feb 2023 14:19:54 GMT

Thanks Kasun for your reply.

I have two different ISPs and IP address provided is also from different network, In such case do i need SW in between or without switch also it will work

Re: ASA Active standby with dual ISP terminated on two different route

sajid231088 — Mon, 06 Feb 2023 14:20:54 GMT

Thanks Karsten,

any configuration reference for both ASAs.

Re: ASA Active standby with dual ISP terminated on two different route

Kasun Bandara — Mon, 06 Feb 2023 14:32:22 GMT

if you have 2 ISPs, each needs to connect to both ASAs using 2 links. for ex,

--------->ISP1 network ----> ASA1

ISP1----> --------->ISP2 network ----> ASA1

Switch

ISP2----> --------->ISP1 network ----> ASA2

--------->ISP2 network ----> ASA2

Re: ASA Active standby with dual ISP terminated on two different route

MHM Cisco World — Mon, 06 Feb 2023 22:29:21 GMT

https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Aug2013/CVD-FirewallAndIPSDesignGuide-AUG13.pdf

this link can help you in config