Hello All,
I'm working on a solution for a client, whereby they have two two sites, with sub ms connectivity and diverse paths (multiple dedicated fibers/wavelengths taking different physical paths through the city, diverse building entrances, etc...), and would like to migrate to a solution where the two ASA's they have in an active/passive configuration can be split between the locations.
The caveat is that aside from the failover links themselves, they (and I) don't want to stretch the outside/inside subnets between the sites. The original thought was to use a loopback or virtual IP to terminate traffic, and use BGP to advertise that VIP/interface depending on who's active (as BGP will only be active on the active ASA), and maintain config sync and member health using two diverse failover links. Something anycast-"ish"
I realize this is an unsupported/non-standard configuration... but I'm wondering if there is any way to do this.
Limitations I've run into so far
- ASA doesn't support loopbacks
- Because the outside network isn't shared between sites, non-monitored external interfaces on two different subnets would be required
- I tried setting up a same-security-level subnet that is shared between sites, if only for a monitored interface, to terminate VPN traffic on... but I keep getting "unable to find egress interface"
So yeah... Any bright ideas?
