Solved

Cisco ASA Load Balance Default Route

Posted on 2013-06-21
4
1,721 Views
Last Modified: 2013-06-24
I am trying to set up a config that will load balance between two default routes on my Cisco ASA5515.  I want to avoid a "black hole" when a link goes down by using conditional tracking.  Would this config work?



Pertinent Routing Configuration

(Configure Tracking for Static Default Routes For Automatic Failover)
#sla monitor 101
#type echo protocol ipIcmpEcho 1.1.1.1 interface outside
#exit
#exit
#sla monitor 101 schedule life forever now
#track 101 rtr 101 reachability

#sla monitor 100
#type echo protocol ipIcmpEcho 1.1.1.2 interface outside
#exit
#exit
#sla monitor 100 schedule life forever now
#track 100 rtr 100 reachability

(Basic Static Route Config)
#route 0.0.0.0 0.0.0.0 1.1.1.1 track 101
#route 0.0.0.0 0.0.0.0 1.1.1.2 track 100
0
Comment
Question by:marrj
  • 2
4 Comments
 
LVL 1

Author Comment

by:marrj
Comment Utility
Each default route will point to an enterprise edge router that will be running both eBGP to the clouds and iBGP between the peers.
0
 
LVL 20

Expert Comment

by:rauenpc
Comment Utility
The ASA cannot do load balancing, only failover.... for the most part.

You can configure dual default routes and make nat statements in such a way that you will get a load balanced result, but this is not a recommended design and it may or may not work in your environment altogether. It would probably be better to either have the routers do all the load balancing (and either have the ASA still configured for failover or the routers configured as FHRP) or have the ASA participate in a dynamic routing protocol such as OSPF or EIGRP in order to get some active balancing.
0
 
LVL 11

Accepted Solution

by:
naderz earned 500 total points
Comment Utility
Actually, the ASA is capable of a round-robin distribution of traffic for up to three equal cost routes. For full details see:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/route_static.html#wp1119601

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/route_static.html#wp1121567


What you have as far as SLA configs and Tracking looks theoretically sound, but it should be tested in action.

You have mentioned that your edge routers are running eBGP to your ISPs (I am assuming) and iBGP between themselves. I am further assuming that you are receiving default routes from each ISPs and that you have everything configured so the path back to your network is deterministic from the outside (e.g. prepending).

If the above assumptions are true, then one other possible way to avoid black holes as far as your ASA is concerned would be to use HSRP on the inside (connecting to the ASA) interfaces of the edge routers and track those HSRPs using routes in the route table or the icmp sla you have above. So you could have two different HSRP addresses on each interface tracking a route received from eBGP. If the route is not present for any reason, then the other edge router would take over. You have other options for tracking on the edge router depending on the type of interface and version, etc. Please send a note if that is not clear.
0
 
LVL 1

Author Comment

by:marrj
Comment Utility
Yes, both ISPs are advertising a default route only.  Your question regarding my configuration so that the path back to me is determined from the outside is not clear to me.  I was under the impression that this is the default behavior for BGP.  So, to my knowledge, it is prepending.  I did take your advice, somewhat, and go for the first-hop redundancy at the edge routers.  I have posted my design for verification here.  I will still award you the points for this question though.  Thank you for your input.  http://www.experts-exchange.com/Networking/Network_Management/Network_Design_and_Methodology/Q_28166366.html
0

Featured Post

Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

Join & Write a Comment

Suggested Solutions

There are times where you would like to have access to information that is only available from a different network. This network could be down the hall, or across country. If each of the network sites have access to the internet, you can create a ne…
Microservice architecture adoption brings many advantages, but can add intricacy. Selecting the right orchestration tool is most important for business specific needs.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now