topic Re: ASA 5510 DUAL ISP PROBLEM in Network Security

ASA 5510 DUAL ISP PROBLEM

trustcisco — Mon, 11 Mar 2019 17:07:08 GMT

Hello,

I have configured dual ISP on my ASA Firewall for redundancy. Everything is working fine. When my first link becomes unavailable the asa switches to the backup link, but when my primary link is online again the asa never switches to my primary link.

What do i have to do so that my asa switches back to my primary link when it becomes active again ?

Thanks.

Re: ASA 5510 DUAL ISP PROBLEM

trustcisco — Wed, 10 Feb 2010 09:38:39 GMT

I have noticed that although my primary link is up for an unknown reason my asa switches to my backup link.

Has anybody faced such a problem ?

Thanks.

Re: ASA 5510 DUAL ISP PROBLEM

riccardo-patti — Wed, 10 Feb 2010 13:03:49 GMT

Hi,

Can you post the config?

Re: ASA 5510 DUAL ISP PROBLEM

trustcisco — Wed, 10 Feb 2010 14:07:32 GMT

route outside 0.0.0.0 0.0.0.0 1.1.1.1 1 track 1
route backup 0.0.0.0 0.0.0.0 2.2.2.2 254

sla monitor 123
type echo protocol ipIcmpEcho isp_dns_ip interface outside
num-packets 3
frequency 120

sla monitor schedule 123 life forever start-time now
track 1 rtr 123 reachability

I have changed the target ping ip address to an ip address of a router which is very close to my firewall.Till now everything is working fine.

Re: ASA 5510 DUAL ISP PROBLEM

Kureli Sankar — Wed, 10 Feb 2010 14:13:55 GMT

CSCtc16148
CSCsk65652

Check them both out. Neither of them is resolved yet.

Symptom:

Route Tracking may fail to fail back to the primary link/route when restored.

Conditions:

SLA monitor must configured along with ip verify reverse path on the tracked interface.

Workaround:

1. Remove ip verify reverse path off of the tracked interface

or

2. add a static route to the SLA target out the primary tracked interface.

Further Problem Description:

N/A

-KS

Re: ASA 5510 DUAL ISP PROBLEM

trustcisco — Thu, 11 Feb 2010 10:03:05 GMT

It seems that i have the same problem that you describe.

I switch succesfuly to the backup link but when the primary links in online again ASA never switches back to the primary link.

I will remove ip verify reverse-path and see what happens....

Re: ASA 5510 DUAL ISP PROBLEM

trustcisco — Thu, 11 Feb 2010 10:11:04 GMT

The no ip verify reverse-path on my tracked interface did the trick. Everything is working perfectly now.

Thanks for you help.

Re: ASA 5510 DUAL ISP PROBLEM

Kureli Sankar — Fri, 12 Feb 2010 01:11:03 GMT

Glad to hear. Thanks for rating.

-KS