How can we connect ASAs in HA to two ISPs?

[Praveen Kumar]

How can we connect ASAs in HA to two ISPs?

Details

We have two (HA pair- active/standby) ASA 5525s with Firepower running FTD codes and services as the internet-edge firewall and L2L VPN gateway. In HA pair, the active firewall will use the primary IP, in other works, primary and secondary firewalls use the same IP depending on which one is active. Since these firewalls terminate L2L VPN tunnel, we will have to use public IPs provided by the ISPs.

Question

How do we configure the outside interface of these firewalls and connect to the internet circuit? 

[Chakshu Piplani · Accepted solution]

Hi Praveen,

You can leverage PBR for this : https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/flexconfig_policies.html?bookSearch=true#Cisco_Task_in_List_GUI.dita_bc40fbd4-5a79-48ae-bf3e-34b7f8a1ec9f

https://integratingit.wordpress.com/2021/04/18/ftd-policy-based-routing/

Regards,

Chakshu

Do rate helpful posts!

[Praveen Kumar]

Thanks for your response. We have two firewalls in HA mode (active/standby). 

[balaji.bandi]

Question

How do we configure the outside interface of these firewalls and connect to the internet circuit? 

there is 2 ways can do this, some design directly terminate to ASA interface, some does Layer 2 Switch between ISP Link and FW,

you can PBR for route the traffic respected ISP, and do Failover with IP SLA here.

[Praveen Kumar]

Let's pretend these are public IPs provided by ISPs. 

ISP-A 10.10.10.10

ISP-B 10.20.20.20

We have FTDs in HA (active/standby) mode. I will configure the outside interface like this "interface Gi0/0 (outside) ip address 10.10.10.10 255.255.255.0 standby 10.20.20.20. ISP-A is connected to primary FTD and ISP-B is connected to secondary FTD. 

If ISP-A fails, the secondary FTD will try to take over as active and use 10.10.10.10 as active IP and 10.20.20.20 as standby IP, but 10.10.10.10 will down. 

Key Points

1. The public IPs will be provided by ISPs and these firewalls terminate L2L VPNs, so I don't think we can have layer 2. 

2. There are two different ISPs.

3. ASA5525 with Firepower are running FTD and are in high-availability mode. It would be easier if it was one firewall, but for high-availability we have two firewalls in HA (active/standby). 

Thanks for your response. 

[balaji.bandi]

Thats not the how high availability works.

If you do not have any Layer 2 Switch =

You need to configure 2 outside interface towards ISP1 and ISP2 ( example Gi 0/1(ISP1)  Gi 0/2(ISP2)

Above post have detailed steps - for informationa gain :

https://integratingit.wordpress.com/2020/08/14/ftd-dual-isp-failover/

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699-configure-ftd-high-availability-on-firep.html

[Chakshu Piplani]

As mentioned by Balaji, this is not how HA works, you can have two ISPs and through SLA monitoring config. do an auto switch between ISPs (connected on diff ports) without failover of FTD units.