troubleshooting Question

2 ISP blocks, 2 ASA's

Avatar of s_coad5
s_coad5Flag for United States of America asked on
Internet ProtocolsNetwork Architecture
19 Comments1 Solution592 ViewsLast Modified:

I currently have 2 sites each with their own ASA. We only had 1 ISP block.

We have added a new ISP block so now we have an ISP block for each site.

Each site will be configured to prefer a particular ISP block.

iBGP will be configured between the routers so that if one site fails, the other
will take over.

I am not sure how to configure the ASA interfaces. Each ASA has (4) interfaces.

interface Gi0/0 on both ASA's is in the subnet of the original ISP block.

Neither ASA has an interface configured in the new ISP block. For Nat/Pat to occur,
i need and interface on the ASA's to be in new ISP block.

My goal: Because each ASA will be a failover for the other,I will need the ability for each ASA to Nat/Pat both ISP blocks. (My 10.x.x.x addresses will be assigned to ISP block A and my 192.168.x.x addresses will be assigned to ISP block B)

Can I configure Gi0/3 on each ASA with the new ISP block subnet address thereby having (2) outside interfaces, 1 for each ISP block?

To make sure ibgp works will I need (2) neighbor statements on each ASA such as:

router bgp 23064                  
no synchronization
bgp log-neighbor-changes
network 216.x.x.0 mask
network 12.x.x.x
neighbor 12.x.x.77 remote-as "telco as#"
neighbor 12.x.x.77 send-community
neighbor 12.x.x.77 route-map SETLP out
neighbor 216.x.x.11 remote-as "my as#"
neighbor 216.x.x.11 next-hop-self
neighbor 12.x.x.1 remote-as "My as#"
neighbor 12.x.x.1  next-hop-self
Join the community to see this answer!
Join our exclusive community to see this answer & millions of others.
Unlock 1 Answer and 19 Comments.
Join the Community
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 19 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros