Running BGP on FTD 4110 and 2140 firewalls managed by FMC

[ABaker94985]

We have an internal initiative to get external BGP up and running; however, we won't have the routers available until next FY. We're looking at using the FTDs to get a summary route from the peers, but I have some concerns. We recently tried to configure two instances of EIGRP with the 4110's, which wasn't supported. We also were not successful with the TAC in getting EIGRP and OSPF redistributed in both directions. I have some questions about BGP on the FTDs:

1) Is this stable?

2) Can you run BGP to two different ISPs (obviously with two different ASNs) on two different interfaces simultaneously?

3) When doing #2, are there problems with NATing, e.g. same public IP for a host on two different public interfaces but the same internal interface? Are there problems with asymmetrical routing with traffic going out to one ISP but returning on another ISP connected to a different interface?

4) Are there any other limitations or considerations?

The FTDs and FMC are either running or will soon be running 7.0.1.

Thanks, all. 

[MHM Cisco World]

can you draw the topology?

[ABaker94985]

Here is the layout. Thank you.

[MHM Cisco World]

so you both the Outer SW can not support BGP ?

[ABaker94985]

Negative, the switches don't support BGP. We'll be purchasing L3 switches or routers next FY, but until then, we don't have any hardware on hand we can use. That's what's driving us to use BGP on the Firepowers, but I'm not 100% confident we won't have some issues.

[ABaker94985 · Accepted solution]

Someone came up with some money to purchase routers. I'm still not sure what the issues would be with BGP on the Firepowers, but I'll close this down for now. 

[MHM Cisco World]

We by connect both ISP to one router and then connect this router to both FTD remove the chance of asymmetric flow, asymmetric flow meaning the FTD receive return traffic and drop it. 
some feature as TCP-bypass use for this case but still there is chance for drop. 
with one router connect, the FTD have one point to internet and router have one point to internal subnet.
if the FTD failed then the router will shift this traffic to other FTD. 

[ABaker94985]

I agree this makes the most sense to do, so I'm glad we're able to move forward with this solution. Thank you for your time.