topic Cisco ASA firewalls do not in Network Security

For Cisco Security processional

eng.taher_gabr — Tue, 12 Mar 2019 05:01:17 GMT

I have new internet connection line and i want to connect it with the primary internet connection through ASA 5510 ver 9.1

Kindly i need ideas

the first line is working fine and want to implement the second line for load sharing purpose

Regards

Cisco ASA firewalls do not

Marvin Rhoads — Sun, 02 Nov 2014 19:21:59 GMT

Cisco ASA firewalls do not support dynamic load sharing via multiple interfaces.

You can setup one to be a backup for the other but for true load sharing you need a router that terminates both lines and uses mechanisms like policy-based routing or BGP with full route tables to make decisions based on things like best path to a given destination.

HI Mr.Marvinyou are right ASA

eng.taher_gabr — Mon, 03 Nov 2014 06:31:36 GMT

HI Mr.Marvin

you are right ASA firewall not supporting load sharing ,

I like to tell you the whole situation :-

I have internet line through cisco router 3825 connected to ASA 5510 ver 9.1 then ( the ASA Inside Connected to untrusted interface Palo Alto Firewall then the trusted interface palo alto connected to core swithc 4506 E and to the inside network)

so , i have new internet line and i want to use the two lines at the same time between users with the same network design,,

please help about this

Hi,I think this should answer

Vibhor Amrodia — Tue, 04 Nov 2014 15:39:06 GMT

Hi,

I think this should answer your query:-

https://supportforums.cisco.com/document/49756/asapix-load-balancing-between-two-isp-options

Thanks and Regards,

Vibhor Amrodia

thanks Vibhor ,,, but it is

eng.taher_gabr — Sun, 09 Nov 2014 07:52:58 GMT

thanks Vibhor ,,,

but it is not helping

So in the situation you

Marvin Rhoads — Sun, 09 Nov 2014 14:36:22 GMT

So in the situation you described the second Internet connection would go to the 3825 router. There you would let the routing protocol (e.g. BGP) dynamically choose the best path based on the configured BGP metrics. This would depend on taking a full routing table and not simply a default route.

You could also optionally use a more advanced feature like Performance Routing (PfR) in the 3825.

In either case, the ASA would have a default route to the 3825 and not have any part in making the choice between path A and path B.