Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Cisco ASA Load Balance Default Route

Posted on 2013-06-21
4
1,824 Views
Last Modified: 2013-06-24
I am trying to set up a config that will load balance between two default routes on my Cisco ASA5515.  I want to avoid a "black hole" when a link goes down by using conditional tracking.  Would this config work?



Pertinent Routing Configuration

(Configure Tracking for Static Default Routes For Automatic Failover)
#sla monitor 101
#type echo protocol ipIcmpEcho 1.1.1.1 interface outside
#exit
#exit
#sla monitor 101 schedule life forever now
#track 101 rtr 101 reachability

#sla monitor 100
#type echo protocol ipIcmpEcho 1.1.1.2 interface outside
#exit
#exit
#sla monitor 100 schedule life forever now
#track 100 rtr 100 reachability

(Basic Static Route Config)
#route 0.0.0.0 0.0.0.0 1.1.1.1 track 101
#route 0.0.0.0 0.0.0.0 1.1.1.2 track 100
0
Comment
Question by:marrj
  • 2
4 Comments
 
LVL 1

Author Comment

by:marrj
ID: 39267156
Each default route will point to an enterprise edge router that will be running both eBGP to the clouds and iBGP between the peers.
0
 
LVL 20

Expert Comment

by:rauenpc
ID: 39267509
The ASA cannot do load balancing, only failover.... for the most part.

You can configure dual default routes and make nat statements in such a way that you will get a load balanced result, but this is not a recommended design and it may or may not work in your environment altogether. It would probably be better to either have the routers do all the load balancing (and either have the ASA still configured for failover or the routers configured as FHRP) or have the ASA participate in a dynamic routing protocol such as OSPF or EIGRP in order to get some active balancing.
0
 
LVL 11

Accepted Solution

by:
naderz earned 500 total points
ID: 39268409
Actually, the ASA is capable of a round-robin distribution of traffic for up to three equal cost routes. For full details see:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/route_static.html#wp1119601

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/route_static.html#wp1121567


What you have as far as SLA configs and Tracking looks theoretically sound, but it should be tested in action.

You have mentioned that your edge routers are running eBGP to your ISPs (I am assuming) and iBGP between themselves. I am further assuming that you are receiving default routes from each ISPs and that you have everything configured so the path back to your network is deterministic from the outside (e.g. prepending).

If the above assumptions are true, then one other possible way to avoid black holes as far as your ASA is concerned would be to use HSRP on the inside (connecting to the ASA) interfaces of the edge routers and track those HSRPs using routes in the route table or the icmp sla you have above. So you could have two different HSRP addresses on each interface tracking a route received from eBGP. If the route is not present for any reason, then the other edge router would take over. You have other options for tracking on the edge router depending on the type of interface and version, etc. Please send a note if that is not clear.
0
 
LVL 1

Author Comment

by:marrj
ID: 39272901
Yes, both ISPs are advertising a default route only.  Your question regarding my configuration so that the path back to me is determined from the outside is not clear to me.  I was under the impression that this is the default behavior for BGP.  So, to my knowledge, it is prepending.  I did take your advice, somewhat, and go for the first-hop redundancy at the edge routers.  I have posted my design for verification here.  I will still award you the points for this question though.  Thank you for your input.  http://www.experts-exchange.com/Networking/Network_Management/Network_Design_and_Methodology/Q_28166366.html
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
ASA ISP failover 3 23
Receiving wifi on an underground station 22 89
Cisco EIGRP Network 6 20
NTP configuration on Cisco switch 3 12
In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
Data center, now-a-days, is referred as the home of all the advanced technologies. In-fact, most of the businesses are now establishing their entire organizational structure around the IT capabilities.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question