topic Re: ASA 5505-X Firewall multiple ISPs load balancing in Network Security

ASA 5505-X Firewall multiple ISPs load balancing

Moudi — Fri, 21 Feb 2020 16:30:37 GMT

Hello,

I have 3 ISPs coming into my ASA 5505-X.

One of them is already configured by the previous sysadmin, i have never touched the configuration and i'm afraid of doing something that may affect it.

I would like to configure the additional two for load balancing, not application specific but just 33/33/33 user split; but have no idea where to start with the current configuration.

current running config:

https://pastebin.com/0TMwQhdr

What can be done here?

Re: ASA 5505-X Firewall multiple ISPs load balancing

Sheraz.Salim — Tue, 27 Nov 2018 12:34:12 GMT

I noted you have one outside interface (gig1/1) with public address. however there is no other interface use as outside.

i belive you mean you will connect remaining outside (ISP cables) to this firewall. Is my understanding is correct?

I dont think you can do a load balance the 3 outside interfaces. however you can create an ip sla. if one link goes down other will kick in.

Re: ASA 5505-X Firewall multiple ISPs load balancing

mkazam001 — Tue, 27 Nov 2018 13:55:36 GMT

link below may be helpful:

https://community.cisco.com/t5/security-documents/loadbalancing-dual-isp-on-asa/ta-p/3127108

regards, mk

please rate if helpful 🙂

Re: ASA 5505-X Firewall multiple ISPs load balancing

Moudi — Tue, 27 Nov 2018 14:03:24 GMT

Yea, the other ISPs are coming on Gbport 2 and 3 which are not yet configured, that's what i need help with.

I am looking to go for load balancing and not just a failsafe mechanism.

Re: ASA 5505-X Firewall multiple ISPs load balancing

Sheraz.Salim — Tue, 27 Nov 2018 14:03:40 GMT

Thanks very helpful

Re: ASA 5505-X Firewall multiple ISPs load balancing

Moudi — Tue, 27 Nov 2018 14:04:24 GMT

Hello Mkazam 🙂

Thank you for the URL, that was the top result i ran into; however I am unsure how to implement it with my current setup, which is why i'm here for help 😞

Re: ASA 5505-X Firewall multiple ISPs load balancing

mkazam001 — Tue, 27 Nov 2018 14:17:06 GMT

I don't think you can do LB, as Sheraz suggested you can use IP SLA - where you will have more than 1 default route with different ADs - if the primary link goes down, that route will be removed from the routing table & the next route will appear pointing to your secondary path next hop.

You could share traffic load by implementing policy based routing - with this config you can set the next hop for traffic based on the source destination.

Regards, mk

Please rate if helpful 🙂

Re: ASA 5505-X Firewall multiple ISPs load balancing

Moudi — Tue, 27 Nov 2018 14:56:43 GMT

That makes sense yea.

Thank you friend, i'm going to look into another piece of hardware to satisfy the load balancing instead.

Re: ASA 5505-X Firewall multiple ISPs load balancing

mkazam001 — Tue, 27 Nov 2018 15:10:39 GMT

happy to help!!

regards, mk

Re: ASA 5505-X Firewall multiple ISPs load balancing

Kasun Bandara — Wed, 28 Nov 2018 06:13:53 GMT

Hi,

you can use Zone based routing to do load balancing. please check the below link for more information.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa93/configuration/general/asa-general-cli/interface-zones.html#pgfId-1066228

regards,