ASA 5520 Dual Active ISPs

[larze2203]

I inherited a network redesign project mid implementation and ran across an issue that I was not 100% sure able to be resolved.  Implementation is occurring in which the organization is changing over to a different ISP and we have some customers that will not be able to change their settings over to our new addresses from some time.  I have seen a lot of posts about fail over and dual ISP configurations, but I could not relate them to this particular scenario. 

Theoretical Layout:

ISP1 - Old

ISP2 - New

ISP1          ISP2

     \            /

    2x ASA 5520 - DMZ

            |

       Internal

ASA 5520s are on version 8.0 and running Active/Active

We have an FTP server in our DMZ and a secondary server in our Internal LAN that customers communicate with.  The issue that I have been faced with is that some customers will be using ISP1 while others are using ISP2 until the full transition occurs.  Since the customers have explicit firewall rules that only accept communication from a certain source address, we cannot send out the traffic just on ISP2 until they change their settings.

Any ideas or thoughts on how to configure to be able to make this happen?

[Julio Carvajal]

Hello,

I think you are looking for load balancing implementation and unfortunately the ASA does not support that feature yet.

There are some workarounds that are not supported by Cisco because as I told you this is supported yet, but you definitly can give it a try.

Here is the link you can use to get more information about the workaround:

https://supportforums.cisco.com/docs/DOC-15622

Please rate helpful posts,.

Kind regards,

Julio

[Jeff Van Houten]

Isn't this just a routing problem? Destination-old-customer gateway=old-ISP. That will cause traffic destined for a specific destination to be routed from the old ISP address. Static routes, not sexy, but work.

Sent from Cisco Technical Support iPad App

[Julio Carvajal]

Hello Jeff,

If you are going to use the old ISP just for the traffic comming from the old customer YES, you can set up a static route on the ASA and the ASA will do a route lookup every time he receives or send a packet to that particular host so it should not be a problem.

Please rate helpful posts.

Regards,

Julio