Good morning,
I've got a question about failover on ASAs. Comparing to a cisco router, on a router, I can setup an sla monitor and an icmp-echo. Under the track I can say delay down and delay up. Meaning, if I ping every 15 seconds, I can say delay down 45 seconds. What this does is wait for 1 minute of unsuccessful pings of an internet ip before triggering failover to a backup ISP. The first ping at 15 seconds tests down, then there's 3 more tests (45 seconds), before the track says "ok this ping destination is down." Really nice if there's a large load on the router that's the cause of the timeouts, or if the ISP link is simply shakey from time to time.
I opened a tac case on the ASA version and I couldn't get a straight response, nor a direct example. After 3 weeks and much discussion, I closed the case.
I've some clients with shakey connections (dozen or so out of 400-500 of em), and their failover is triggering at the slightest pause on the line. I've set the ipicmpecho ip in an access list and prioritized traffic to the IP in a service policy on the outside interface.
I'm aware of timeouts, and the timeouts cannot be greater then the frequency. So i'm still contained within the single test window. I've set timeouts to 20000 in a 20 second frequency, and still trigger failover when my ping times start exceeding 2000ms under a heavy load.
I've even tried multiple tracks on various internet ips, and then tried to stack multiple default gateways out the same interface. IE, If one internet ip fails, there's still 2 tracks that might be responding. Thus all three internet ips and weighted routes need to fail before falling to the lowest weighted default gateway out the backup ISP. ASA only lets me do 1 tracked route per gateway.
Specifically, if i wanted to setup a test every 15 seconds on an ASA, but delay down for 3 more subsequent tests, what would be the command structure for this (if any available on the ASA?).
Cisco TAC said do this : (does not delay down)
sla monitor 123
tyep echo protocol pipicmpecho x.x.x.x interface outside
num-packets 5
timeout 20000
freq 20
track 1 rtr 123 reachability
Running 8.25
Thanks
