Cisco ASA Active/Standby VPN/Load Balancing/SourceFire

[Oscar Bonilla]

Hello All,

We are working on a project with two ASAs and we would like some suggestions on how to achieve the following:

Current Scenario:

- ASAs right now are on Active/Standby

- There are two ISPs. Backup ISP is being monitored automatically by SLA.

- VPNs

What our customer wants:

- Load Balance the outgoing traffic between the two ISPs (We know that we would need to bring a router and route maps into place). ISP1 for Management / ISP2 for the rest of the users.... but both of them being backup for the other.

- Site to Site VPN and Site to Client VPN, via ISP1.

- We would like to keep all the SourceFire functionallities.

- We would like to keep HA between the two ASAs.

Have any of you ever donde something like this?

Thanks all!

[Vibhor Amrodia]

Hi,

I think this should be possible with using the SLA monitor with PBR on the ASA device 9.4.1 and above

Thanks and Regards,

Vibhor Amrodia

[ch02all]

HI, Please would you let me know if you got this working. We have a similar scenarios with two ISP and address blocks.

ISP routers direct to 5512 with sec plus lic. and 9.2.1 code supporting BGP.

Do you need L3 switch in front of the ASA.

would be interested in what you ended up with.

Thanks all