For internet peering, if you can run routing like i said earlier, you should go for it.
I don't see how provider address space or provider independent address space should make a differce.
If your concern of /27 and you loosing addressing blocks is the concern, then there are other ways to work that out.
Also tell me if your interent facing links are configured with private IPs or public?
If public, then is it part of the same /27 subnetted or full /27 mask. If not part of /27,then what is it ? /30?
Anyways, if you can't run a protocol with your providers, then you can run ip sla with tracking to flap your default route when
connectivity is lost with the isp. You can either choose to track upto gateway or even beyond to some known server.
Redistribute this default route into eigrp which you run between routers and ASA, and ASA will know if your uplink is up or down.
ip route 0.0.0.0 0.0.0.0 64.1.1.1 track 1
track 1 rtr 1
ip sla 1
icmp-echo 64.1.1.1 source-interface FastEthernet0/0
frequency 10
router eigrp 1
no auto-summary
network 10.0.0.0
redistribute static
---
Load balancing in current scenario may not work because of different ip pools from providers,
Now i see why you were saying dual natting, cause you want to nat the internet
traffic inbound going to ASA so that the ASA cna identify which router to send back
the traffic to, else the providers would drop it if they got each others addresses
in the source IP on the way out.
However, there are a few issues here:
1. Routers don't support doing a reverse nat outside --> for this scenario.
It just isn't supported, even though an outside to inside nat is configurable,
what matters is which part of the IP is getting changed, and how routing will affect
this as well, as there are different rules for natting in routers when it comes
to nat order of operation.
2. Internet IP table is huge. Even if you don't get huge amounts of traffic, expect
some 10s of thousands of NAT entries just for internet traffic which can
cause resource utilization to go high and overload .
3. ASAs have a trick with which you can do reverse nat, but trust me, you won't get support
from TAC on this. I think they'll deny that it can even be done, even though i know it can
and has been done before in only exception cases. Even if you find someone who can do it for you,
anytime that there is an issue and you need to go to TAC or a consultant for support,
you'll be refused as it's agaist all design guides and best practices. There would be unpredictable behavior.
You'll be left hanging in the middle in such a scenario.
4. Because of this, you'll have to re-think your design, maybe when it comes to ASAs.
In this case, NATTING will have to be done on the routers. ASA can be free of any NAT config in your case.
You might be thinking that you can NAT everything on the ASA and then just NAT the ASA IP on the router.
It doesn't make much difference unless you have a specific purpose to nat on the asa. It's more or less the same thing.
Other than that, NATTING everyting on the routers also gives you one advantage. You can configure netflow
on the routers and get a good insight into the traffic flows, specially during malicious activities or if there is a DOS attack,
or if a user is hogging a lot of your bandwidth, intentionally (torrents) or unintentionally. You can also fine tune QoS based on inside IP address groups
on the router for internet bandwidth, which would be tougher if you just had one ASA NAT IP arriving on the router (deep packet inspection = more cpu).
