Cisco ASA Load Balance Default Route

I am trying to set up a config that will load balance between two default routes on my Cisco ASA5515.  I want to avoid a "black hole" when a link goes down by using conditional tracking.  Would this config work?



Pertinent Routing Configuration

(Configure Tracking for Static Default Routes For Automatic Failover)
#sla monitor 101
#type echo protocol ipIcmpEcho 1.1.1.1 interface outside
#exit
#exit
#sla monitor 101 schedule life forever now
#track 101 rtr 101 reachability

#sla monitor 100
#type echo protocol ipIcmpEcho 1.1.1.2 interface outside
#exit
#exit
#sla monitor 100 schedule life forever now
#track 100 rtr 100 reachability

(Basic Static Route Config)
#route 0.0.0.0 0.0.0.0 1.1.1.1 track 101
#route 0.0.0.0 0.0.0.0 1.1.1.2 track 100
LVL 1
marrjAsked:
Who is Participating?
 
naderzConnect With a Mentor Commented:
Actually, the ASA is capable of a round-robin distribution of traffic for up to three equal cost routes. For full details see:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/route_static.html#wp1119601

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/route_static.html#wp1121567


What you have as far as SLA configs and Tracking looks theoretically sound, but it should be tested in action.

You have mentioned that your edge routers are running eBGP to your ISPs (I am assuming) and iBGP between themselves. I am further assuming that you are receiving default routes from each ISPs and that you have everything configured so the path back to your network is deterministic from the outside (e.g. prepending).

If the above assumptions are true, then one other possible way to avoid black holes as far as your ASA is concerned would be to use HSRP on the inside (connecting to the ASA) interfaces of the edge routers and track those HSRPs using routes in the route table or the icmp sla you have above. So you could have two different HSRP addresses on each interface tracking a route received from eBGP. If the route is not present for any reason, then the other edge router would take over. You have other options for tracking on the edge router depending on the type of interface and version, etc. Please send a note if that is not clear.
0
 
marrjAuthor Commented:
Each default route will point to an enterprise edge router that will be running both eBGP to the clouds and iBGP between the peers.
0
 
rauenpcCommented:
The ASA cannot do load balancing, only failover.... for the most part.

You can configure dual default routes and make nat statements in such a way that you will get a load balanced result, but this is not a recommended design and it may or may not work in your environment altogether. It would probably be better to either have the routers do all the load balancing (and either have the ASA still configured for failover or the routers configured as FHRP) or have the ASA participate in a dynamic routing protocol such as OSPF or EIGRP in order to get some active balancing.
0
 
marrjAuthor Commented:
Yes, both ISPs are advertising a default route only.  Your question regarding my configuration so that the path back to me is determined from the outside is not clear to me.  I was under the impression that this is the default behavior for BGP.  So, to my knowledge, it is prepending.  I did take your advice, somewhat, and go for the first-hop redundancy at the edge routers.  I have posted my design for verification here.  I will still award you the points for this question though.  Thank you for your input.  http://www.experts-exchange.com/Networking/Network_Management/Network_Design_and_Methodology/Q_28166366.html
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.