Cisco ASA 5510 ISP Failover

How to create a ISP Failover on a cisco asa 5510. What do you need to create this solution…

  1. You need 2 Internet Providers.
  2. You need for both ISP an internet device ( in bridged modus )
  3. You need one Cisco asa 5510 with a security bundle

Prior to start with you configuration. Keep in mind you can use this in combination with a Statefull fallback solution of 2 Cisco ASA 5510’s.

interface Ethernet 0/2
 description internet connection ISP 1
 nameif outside
 secutiry-level 0
 ip address < external ip address> <subnetmask>

Above is the first configuration of the first ISP

interface Ethernet 0/3
 description internet connection ISP 2
 nameif outside2
 security-level 0
 ip address <external ip address> <subnetmask>

Configure a local area network address ( LAN )

interface Ethernet 0/0
 description Local Area Network ( LAN )
 nameif inside
 security-level 100
 ip address < internal ip address> <subnetmask>

Configure a global NAT/PAT

global (outside) 1 interface
global (outside2) 1 interface
nat (inside ) 1

Configure a static route

route outside <gateway ISP 1> 1 track 1
route outside2 <gateway ISP 2> 254

You have to configure now a SLA ( automatic tracking to an external ip address or website )

sla monitor 123
 type echo protocol ipIcmpEcho interface outside
 num-packets 3
 frequency 10

You have to start this monitor through the command.

sla monitor schedule 123 life forever start-time now

After you configured and started the monitor tracker. You will need to point this monitor tracker to a static route which you configured earlier.

track 1 rtr 123 reachability

5 thoughts on “Cisco ASA 5510 ISP Failover”

  1. Pingback: Cisco ASA 5510 ISP Failover « Glazenbakje's Weblog - isp

    1. I didn’t configure yet some with load balancing with 2 ISP’s I just only configured the failover so far.
      I only know it with a normal IOS router ( like the 2821 / 2921 ) that the option is there to load balance the internet connection. But even that I haven’t configured yet.

  2. What happens when the primary ISP back to operational? My ASA 5505 stuck with the secondary ISP. How can I revert back to the primary ISP link?

    1. I think you have to check your tracker configuration. Because I think that the first hop ( the ISP ) has changed to a different address this is why it won’t revert back. other option is to disconnect the secondary internet line to flip it back to the primary.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.