separate firewalls with separate ISP links

[Madura Malwatte]

Hi All,

I am wondering if this is possible, there are two separate ASA's, with their own ISP links. Now if either of the ISP's fail, could the ASA's be configured to route through the other ASA's inside interface and to the other ISP?

example, ISP 1 fails, is it possible to configure a default route on the ASA1 to forward traffic through ASA2? I know we could track ISP1 and set an alternate route if the tracked network fails. But how would this affect ASA's NAT configuration when it's public IP is no longer available and using ASA2's inside interface as the default route next hop?

vlan 10 ------ (inside) ASA1 (outside) ------ ISP 1

 |

 |

switch

|

|

vlan 20----- (inside) ASA2 (outside) ------ ISP2

[Spooster IT Services]

Hi mmalwatte,

Is there static NAT configured on ASA's or only PAT is configured to provide internet access to LAN subnet? 

[Madura Malwatte]

It's just a hypothetical. what would the solution be for both situations?

[Spooster IT Services · Accepted solution]

Hi mmalwatte,

See there are three basic cases,

1) If there is only dynamic PAT for both Vlans (in our case vlan 10 and vlan 20) to provide only internet connectivity, then don't need to worry about it. You only need to configure dynamic PAT for both Vlan on both ASA's.

2) If you have taken subnets from both ISP's and there is static NAT (one to one NAT) configured on both ASA's, then in those case the NAT will not work for those IP's/subnet which is taken from the ISP that fail.

3) If you have taken subnets independent from ISP's (directly from IANA) and advertise by you to both ISP's, then you only need to configure same static NAT rules on both ASA's.

Please remember to marked it as answered :-)