Our organization currently has an ASA 5520 configured with a single ISP link. We have purchased another circuit to provide redundancy. The new link is actually a faster link, and we would like to configure this link as our primary, with the original serving as a backup.
I know the ASA allows configuration of a backup circuit with automatic failover based on tracking the primary route. I know how to configure this. But I'm afraid this is not going to work for us.
Here is my conundrum: Although we wish to configure the new link as the primary link, we have one device that absolutely must continue to utilize the public IP Addresses provided by the ISP on the existing link. This is the link that would be configured as the backup link. I am afraid configuring this link as a backup will stop the ASA from forwarding this absolutely necessary traffic out the associated interface. Can anyone confirm or deny this?
My second thought is to configure the ASA to utilize both links simultaneously. I understand the ASA does not perform source based routing, nor does it perform load balancing. However, this is not what I am looking to achieve. My idea is to simply have both links enabled, then to create a default route that points to the primary link, while creating a static route that pushes all traffic associated with the device I mentioned before to the existing link. Can the ASA effectively route traffic in this manner? Is it possible to configure multiple ISP links to be availabe simultaneously in this, limited fashion?
My third idea is to install an upstream router with a single link to the ASA. I could then terminate both circuits at this device, and create ACL's to direct traffic in the manner mentioned above. This, however, would require the purchase of additional equipment, which I would like to avoid if at all possible.
Thank you in advance!