ASA Active standby with dual ISP terminated on two different router

[sajid231088]

Hi Experts,

Hope you all are doing well.

please help me in below.

We have two ASA configured in Active/Standby, at present we have single ISP but we are going to have second ISP soon.

new topology would be : 

ISP RTR1 -----> ASA1 ------> Core SW1

ISP RTR 2 ----> ASA2 ------> Core SW2

need to know, can i directly connect ISP link with ASA or do i need any Switch in between

If, any switch required what would be switch and ASA configuration  OR  if switch not required then what would be a ASA(both ASA) configuration.

Thanks,

[Karsten Iwen]

It is very likely that you need an additional switch. Both outside interfaces of both ASAs need to see each other. For Example:

• outside1 of ASA1 and ASA2 connect to ISP1
• outside2 of ASA1 and ASA2 connect to ISP2

If the ISP device has two ports you can connect both ASAs to it. But it is quite common that the ISP device only has one port. Here you need a switch to connect both ASAs to the ISP router.

[sajid231088]

Thanks Karsten,

any configuration reference for both ASAs.

[Rob Ingram]

@sajid231088 you should connect the ASA outside interfaces into a switch, in the same vlan as an isp router. That way both ASA can communicate to the isp router.

[Kasun Bandara]

if your ISP gives 2 lines for same connection you can connect that to two ASAs. or use switch between ASAs and ISP router. then connect ISP to switch and 2 cables from switch to 2 ASAs

[sajid231088]

Thanks Kasun for your reply.

I have two different ISPs and IP address provided is also from different network, In such case do i need SW in between or without switch also it will work

[Kasun Bandara]

if you have 2 ISPs, each needs to connect to both ASAs using 2 links. for ex,

                               --------->ISP1 network ----> ASA1

ISP1---->               --------->ISP2 network ----> ASA1

                    Switch 

ISP2---->                  --------->ISP1 network ----> ASA2

                                  --------->ISP2 network ----> ASA2

[MHM Cisco World]

https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Aug2013/CVD-FirewallAndIPSDesignGuide-AUG13.pdf

this link can help you in config