New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

[vishnuvichu36601]

WE CONNECTED NEW ISP INTERFACE TO OUR CISCO ASA.ALREADY WE HAVE 2 ISP IN ASA.WE CONFIGURE THE INTERFACE FOR NEW ISP AND WRITE NEW NAT POLICY FOR ONE VLAN NETWORK TO CHECK WHETHER INTERNET IS WORKING OR NOT,INTERNET IS NOT WORKING.

OUR NAT POLICY IS LIKE

SOURCE INTERFACE IS NEW ISP INTERFACE

SOURCE ADDRESS IS 172.18.*.*/24

DESTINATION INTERFACE IS ANY

DESTINATION ADDRESS IN ANY

DYNAMIC PAT

SOURCE ADDRESS TRANSLATION IS OUTSIDE ISP INTERFACE

PLEASE HELP US TO SOLVE THIS ISSUE.

[Marius Gunnerud]

I am guessing that you did not take down the link to the existing ISP when you test?  And I am also assuming that you have configured a default route pointing out the new ISP interface.

The issue is that the ASA does not support two active default routes at the same time.  You would need to remove the current ISP link (and possibly the default route) to test this.

An option, if the second default route doesn't take over when the existing ISP interface is down is to set up SLA tracking.

[vishnuvichu36601]

Currently two active default routes for current isp and new isp.We didnt remove the current ISP link.Is there any other way for testing the new isp Link with the help of route Map??How to do IP SLA Tracking??

[Marius Gunnerud]

The route map is used for policy based routing (PBR).  You could use this also.  See the folloing link for a guide on PBR.

access-list testACL permit ip 10.10.10.0 255.255.255.0 any

route-map access-test permit 10

  match ip address testACL

  set next-hop <IP of ISP2>

interface gig0/1  <-- ingress interface of source traffic.

nameif inside

security-level 100

ip add 172.16.1.1 255.255.255.0

policy-route route-map access-test

SLA tracking is quite easy to set up.

sla monitor 1

  type echo protocol IpIcmpEcho 8.8.8.8 interface outside

sla monitor schedule 1 start-time now life forever

track 10 rtr 1 reachability

route outside 0 0 track 10

route outside2 0 0 254

[vishnuvichu36601]

My doubts

10.10.10.0 255.255.255.0 ip address ==>> test vlan network ??

[Marius Gunnerud]

10.10.10.0/24 is just an example network I used.  Yes this is the network you are testing from.  You can limit this ACL to a single IP also if you choose.

[vishnuvichu36601]

sir,During these configuration any internet will down for other network?

Can you tell me the SLA tracking?

[Marius Gunnerud]

no internet will not go down when configuring it.  Though when removing SLA tracking from the default route. you will need to remove the route completely and add it back without the tracking.  In this case there might be a small "blip" but that should only last less than a second if you apply the change using a script.

[vishnuvichu36601]

without configure SLA tracking.My test scenario will work or not?

[Marius Gunnerud]

The issue will be that with and without SLA your network will go down if ISP 2 does not work or is not ready.

if you can not have any down time it is probably better to use policy based routing

[vishnuvichu36601]

we already have load-balancing. We need to check only the newly connected
ISP is working or not. So the only pbr is required for our scenario. Is it
correct?

[Marius Gunnerud]

Correct 

[vishnuvichu36601]

Sir, We will configure and tell whether it's worked or not?

[vishnuvichu36601]

hello,Any static route we need to configure for ISP Interface?Can you tell me the static Route is rquired or not?

[Marius Gunnerud]

Static route is not necessary when using PBR