topic yes they provided us a /30 in Network Security

Cisco ASA 5506-x ISP redundancy

rizwan.nadeem — Tue, 12 Mar 2019 09:39:22 GMT

Hello Dear, I need some help. i need to configure WAN fail over, i have one WAN connection with redundant pipe and i have one static IP, so i want to know how can we configure single static IP in two interfaces and make it fail over, if one pipe will down then second pipe will turn on automatically but the public IP is one. i would be very thankful to you if any one can help me. firewall OS 9.6 asdm version is 7.6

Unless you are paying for a

Philip D'Ath — Tue, 04 Jul 2017 08:34:03 GMT

Unless you are paying for a premium business fibre service, you wont be able to use the static IP address from one circuit on another circuit.

Yes, i am paying premium

rizwan.nadeem — Tue, 04 Jul 2017 08:45:15 GMT

Yes, i am paying premium business fiber services but when i enter same public ip to anther interface then it wont allow me to use same ip on another interface. For reference i have attached the image.

please guide me further.

Has the provider confirmed

Philip D'Ath — Tue, 04 Jul 2017 08:49:15 GMT

Has the provider confirmed that they will route the same static IP address down both of your fibre circuits?

If so, which method has the ISP said they want you to use? The ISP will need someone way to know which circuit to route that public IP down.

Yes, they confirmed both

rizwan.nadeem — Tue, 04 Jul 2017 11:05:43 GMT

Yes, they confirmed both fibre circuits have the same static routes.

they asked me to terminate the both circuits on your firewall and then configure it from your ASA, currently one circuit is terminated and working fine but when i configure the second interface with same public ip so it will not allow me to configure.

Can we configure same IP on both interfaces for ISP fail over?

So they can given you a /30

Philip D'Ath — Tue, 04 Jul 2017 11:07:34 GMT

So they can given you a /30 for each circuit, and then the static IP is routed via that?

Or are perhaps these two circuits part of a common layer 2 bridge domain?

If it is a common bridge

Philip D'Ath — Tue, 04 Jul 2017 11:12:14 GMT

If it is a common bridge domain, then you would use a config something like the below. I think you need 9.7 software to use this feature.

interface BVI1
 nameif outside
 security-level 0
 ip address x.x.x.x y.y.y.y
interface GigabitEthernet1/1
 bridge-group 1
interface GigabitEthernet1/2
 bridge-group 1

yes they provided us a /30

rizwan.nadeem — Tue, 04 Jul 2017 11:19:29 GMT

yes they provided us a /30 pool.

This is i m not sure, i need to ask from them.

shall i ask from them?

Ask them how each circuit

Philip D'Ath — Tue, 04 Jul 2017 11:23:11 GMT

Ask them how each circuit should be configured.

Alright, thank you for

rizwan.nadeem — Tue, 04 Jul 2017 11:29:53 GMT

Alright, thank you for helping me, let me ask from ISP then i will get back to you.