inside traffic not routing to backup wan interface when primary down

[ctimm]

This is on an ASA 5516, ASA Version 9.16(3)19

I've configured a backup interface for our backup ISP following this documentation:

Configure the ASA for Redundant or Backup ISP Links - Cisco

The problem is that when the primary is down, traffic from the inside isn't routing through the backup interface.

I have this network object:

object network obj_any
subnet 0.0.0.0 0.0.0.0
object network obj_any
nat (any,outside) dynamic interface

If I add:

object network obj_any_backup
subnet 0.0.0.0 0.0.0.0
object network obj_any_backup
nat (any,outside-backup) dynamic interface

it isn't routing. The same, if I change the 1st to:

object network obj_any
subnet 0.0.0.0 0.0.0.0
object network obj_any
nat (any,outside-backup) dynamic interface

this doesn't work either.

Is there something incorrectly configured or am I missing any configuration?

[balaji.bandi]

that is only object part how about rest of the config, how you tracking the interface to failover expected to work ?

i would suggest to post show run (complete removing any password)

Personally i would not use 0.0.0.0 0.0.0.0 (subnet) for security reason, rather i use what LAN IP address you have example:

object network obj_any
subnet 192.168.1.0 0.0.0.255

The document was well testing many times myself, it works as expected, if you have all steps and config in place ?

by the how are you testing failover ? manually removing cable ? or is this real fail over ?

[ctimm]

It's not the failover or redundant links that is the problem so that's why I didn't post the config.

If I force outside to think it's down by using a tracking IP address that is known to not be pingable, the route for outside-backup properly goes to default, checking with CLI or ASDM as per the link.

The problem is that inside doesn't start using outside-backup as the default route.

This is what was in place prior to adding the outside-backup interface to route all inside (default and VLANs) to the public:

object network obj_any
subnet 0.0.0.0 0.0.0.0
object network obj_any
nat (any,outside) dynamic interface

[balaji.bandi]

It's not the failover or redundant links that is the problem so that's why I didn't post the config. -  we are still blank like filling the spaces here.

couple of question still need to answer ?

Do you have interfaces outside and backup-outside ? (and are they up) ?

when the primary go down, how is your routing table ? what is the packet tracer looks like ?

also what is the outcome of sla track results ?

[MHM Cisco World]

timeout floating-conn 0:01:00

and also you need 
route-lookup keyword must add to NAT command  

[ctimm]

I was hopint that route-lookup would be the key, but I can't add it to the config for any of the object network items.

"

object network obj_any
nat (any,outside) dynamic interface route-lookup

nat (any,outside) dynamic interface route-lookup
^
ERROR: % Invalid input detected at '^' marker.

*Note - I also tried adding the exact same, except with the additional route of the obj_any_backup as described in my earlier posts.

To satisfy the WAN outside portion of things, this is the config:

!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address pri.pri.pri.pri 255.255.255.x
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address in.in.in.in 255.255.255.0
!
interface GigabitEthernet1/3
nameif outside-backup
security-level 0
ip address bak.bak.bak.bak 255.255.255.x
!
route outside 0.0.0.0 0.0.0.0 pri.pri.pri.gw 1 track 1
route outside-backup 0.0.0.0 0.0.0.0 bak.bak.bak.bakgw 254
!
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:30
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
!
sla monitor 123
type echo protocol ipIcmpEcho 1.1.1.1 interface outside
sla monitor schedule 123 life forever start-time now

Again, this seems to be working fine, and I can reach the internal side remotely from either outside or outside-backup interface (when either is up), and can also access the internal devices/servers when either is up.

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118049-config-eem-00.html

check link above 
and please dont forget floating timeout 

[ctimm]

This looks like out routing to a specific IP or network. 

I need ALL 0.0.0.0 traffic from inside to route through the ASA's CURRENT DEFAULT route.

[ctimm]

And - I appreciate your replies and ridiculously quick responses!

The outside isn't issue, it's inside to default that's not routing. All inside is still routing through outside even when outside-backup is default.

[MHM Cisco World]

you must config the route with track 
https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/217974-configure-the-asa-for-redundant-or-backu.html

this link you mention in origin post talk about using track1 
this track will remove default route toward outside and hence the only route in asa is the route toward out-backup

[ctimm]

I have it as track 1

!
route outside 0.0.0.0 0.0.0.0 pri.pri.pri.gw 1 track 1
route outside-backup 0.0.0.0 0.0.0.0 bak.bak.bak.bakgw 254
!

I also have the floating set, again, as far as I understand, this is on HA/failover for WAN purposes. The WAN or BACKUPWAN aren't an issue since I can remotely access inside devices (by rules) via either WAN.

If I need to float the inside, that would be outside the scope of what I am aware of on this IOS

[MHM Cisco World]

if you config route with track and the track not remove the route from ASA then 
check the interface you use in SL monitor, which interface you use?
if you can please share config I need to see it.
thanks

[ctimm]

SLA shows the route just fine, and doesn't  show multiple routes for 0.0.0.0

I will share the full config, but I need to comb through it for identifiable info first before I post.

In the meantime, everything works properly on the outside and outside-backup when outside is down. I can't make inside route to outside-backup when outside is down. 

If it helps, packet traces don't show anything from LAN (inside) to the Backup WAN (outside-backup) when CLI shows default as outside-backup. Packet trace shows them from inside to outside, instead of outside-backup, when outside is down. 

[MHM Cisco World]

I will run lab share with you the config need for this case 

[balaji.bandi]

why are you adding twice here :

nat (any,outside) dynamic interface route-lookup

nat (any,outside) dynamic interface route-lookup
^
ERROR: % Invalid input detected at '^' marker.

Again, this seems to be working fine, and I can reach the internal side remotely from either outside or outside-backup interface (when either is up), and can also access the internal devices/servers when either is up.

i take this as working config  - either up i take this as failuire scenario right ?