topic Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring in Network Security

Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

V Rajshekar — Fri, 21 Feb 2020 15:41:13 GMT

I configured,

interface GigabitEthernet0/0
description WAN
nameif outside
security-level 0
ip address 203.92.x,x 255.255.255.248

interface GigabitEthernet0/3
description TATA_WAN
nameif Backup-link
security-level 0
ip address 203.192.x.x 255.255.255.248

route outside 0.0.0.0 0.0.0.0 203.92.x.x 1 track 10
route Backup-link 0.0.0.0 0.0.0.0 203.192.x.x 2

track 10 ip sla 10 reachability

sla monitor 10
type echo protocol ipIcmpEcho 4.2.2.2 interface outside
frequency 5
sla monitor schedule 1 life forever start-time now

After I added this config, when I check "show route" it does not display the default route.

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

Karsten Iwen — Mon, 30 Apr 2018 08:40:29 GMT

And what does "show route" display? And what gives "show sla monitor operational-state"?

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

Marius Gunnerud — Mon, 30 Apr 2018 10:42:35 GMT

This is odd behavior. I set this up in my home lab and got the same result that when the SLA timeout the backup default route was not entered into the routing table. I then removed the backup route and readded it using administrative distance 254 and that worked. switch back to administrative distance 2 and now that also worked. not sure what happened.

Try what I did, remove it, add it back with 254, test that it works, then remove and add it back with 2.

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

V Rajshekar — Mon, 30 Apr 2018 11:10:35 GMT

Thank you for the quick response.

As soon as I add the SLA monitoring config for the static route. The primary ISP link goes down and the route is deleted from the routing table and the failover also does not happening. I tried it with metric, 2, 10, 254 none of them helped.

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

Marius Gunnerud — Mon, 30 Apr 2018 11:15:21 GMT

is this a typo?

sla monitor schedule 1 life forever start-time now

it should be sla monitor schedule 10 life forever start-time now

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

Marius Gunnerud — Mon, 30 Apr 2018 11:25:57 GMT

Could you post the full running config of the ASA (remember to remove public IPs, usernames and passwords.)

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

V Rajshekar — Mon, 30 Apr 2018 11:33:56 GMT

@Marius Gunnerud Yes that was a typo. In the config s

la monitor schedule 10 life forever start-time now

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

V Rajshekar — Mon, 30 Apr 2018 17:58:28 GMT

Hi @Marius Gunnerud

Thank you. Here you go, this was taken when the issue occurred

For now, i have removed the SLA configuration from the running config as it was causing issues.

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

Marius Gunnerud — Mon, 30 Apr 2018 18:17:07 GMT

This is the first time I have seen "track 10 ip sla 10 reachability" on an ASA. I checked an ASA running version 9.6 and this command is not present on it. could you try changing this to "track 10 rtr 10 reachability"

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

V Rajshekar — Mon, 30 Apr 2018 19:13:23 GMT

Hi @Marius Gunnerud

Sorry, I made a mistake while entering, i tried it with

track 10 rtr 10 reachability

It still behaves the same

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

Marius Gunnerud — Tue, 01 May 2018 09:35:25 GMT

This is odd. could you provide an output of show route before and after failover?

also issue the command show sla monitor operational-state before and after failover.

Also, have you tried a restart of the ASA?

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

V Rajshekar — Tue, 01 May 2018 17:55:07 GMT

Before performing the failover, as soon as the SLA is configured for the primary route, the route is removed. The primary link is still connected and running however for some reason ASA does delete the default routes.

I will try rebooting, I have not tried that yet.

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

Marius Gunnerud — Tue, 01 May 2018 19:24:38 GMT

If it is removed the right when you add tracking to the route, then it sounds like there is an issue with reachability towards 4.2.2.2. Perhaps it is dropped in a firewall in the path or a routing issue. Are you able to ping 4.2.2.2 from the ASA? What if you tried using 8.8.8.8?

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

V Rajshekar — Wed, 02 May 2018 17:19:47 GMT

Hi @Marius Gunnerud

I am able to ping 4.2.2.2 and 8.8.8.8 before adding the SLA config.

However, as soon as I add it, the default route is removed and failover does not happen.

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

Marius Gunnerud — Wed, 02 May 2018 20:19:53 GMT

could you post the full output of show route before and after you add the tracking to the default route.

Also provide the full output of show sla monitor operational-state once you have added tracking.

Re: Configuring Failover DUAL ISP on Single ASA 5515X using Static Route SLA monitoring

V Rajshekar — Fri, 04 May 2018 01:55:58 GMT

Hi @Marius Gunnerud

I tried configuring it today and it started to work and the failover happened. Not sure what was going on there. I did not even reboot it.

Thank you for your help 🙂