ASA5510 - Backup ISP interface does not failback

OSG_DanCisco — Tue, 12 Mar 2019 01:19:24 GMT

Cisco ASA 5510 ASA 8.2(5)
Set up the backup ISP per
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

Basically vanilla configuration

The SLA Target is the DG of the Primary Outside Interface -
The interface will fall over to backup ISP (a DHCP interface). We have seen this occur when APPLYing a change via Cisco ASDM as well as 'planned' cutovers).
The issue is that it does not fall back when the SLA Monitor sees the Target.
sla monitor operational-state reflects a
Latest Operation return code: ok.

However the show route reflects the backup route.
The way I get it back is by bringing down the backup interface.
I thought the following may be helpful:
http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080bc8549.shtml
But this reflects a situation in which the routing table is rebuilt and the original Primary gateway is reinstated.
Again, our route table does not reflect the Primary (until I pull the cable).

One thing I did notice, now, is that the routing table (with the backup) does not show as a S* but d* (lowercase

d, not capital D for EIGRP)

C 192.168.29.0 255.255.255.0 is directly connected,

inside
C 50.196.236.120 255.255.255.248 is directly connected,

outside
C 192.168.39.0 255.255.255.0 is directly connected, dmz
C 192.168.1.0 255.255.255.0 is directly connected,

Backup
d* 0.0.0.0 0.0.0.0 [1/0] via 192.168.1.254, Backup

Wondering what would resolve the issue, so the ASA failbacks to the Primary once it is recognized.

ASA5510 - Backup ISP interface does not failback

jocamare — Fri, 29 Mar 2013 20:24:56 GMT

Mind sharing the sla and interface configuration? The output of the "show route" command will be useful too.

Also the " sho sla monitor operational-state" output.

The "d*" letter you see is used for routes learned via DHCP.

ASA5510 - Backup ISP interface does not failback

Julio Carvajal — Fri, 29 Mar 2013 23:09:12 GMT

Hello Dan,

Can you share your show run?

I would like to see if you have ip verify enable,

Regards

topic ASA5510 - Backup ISP interface does not failback in Network Security

ASA5510 - Backup ISP interface does not failback

ASA5510 - Backup ISP interface does not failback

ASA5510 - Backup ISP interface does not failback