{"id":829,"date":"2009-10-12T19:22:37","date_gmt":"2009-10-13T01:22:37","guid":{"rendered":"http:\/\/gregsowell.com\/?p=829"},"modified":"2009-10-12T19:23:04","modified_gmt":"2009-10-13T01:23:04","slug":"cisco-asa-ip-sla-%e2%80%93-failover-routing","status":"publish","type":"post","link":"https:\/\/gregsowell.com\/?p=829","title":{"rendered":"Cisco ASA IP SLA \u2013 Failover Routing"},"content":{"rendered":"

It seems like everytime I want to do something funky with an ASA, Cisco says \u201cASAs are not routers, use them what they are designed for.\u201d This really doesn\u2019t help me\u2026heh. ASAs can\u2019t do PBR(Policy Based Routing \u2013 aka route maps)\u2026which would have been useful more than a few times. Back on topic, failover routing.<\/p>\n

Route redundancy can be achieved locally using metrics on your routes, as you can in routers. What if you have a point to point link that takes several hops through a provider network, though? If the link dies in the provider, the local link stays up and your bad route stays in the route table\u2026what does one do?<\/p>\n

In steps IP SLA. This provides many functions including the ability to ping a remote host. So, we have one ASA ping the other ASA across the point to point link and if the ping fails, we drop the route across the P2P.<\/p>\n

Here is a logical diagram of how it all works.<\/p>\n

\"asa-ipsla\"
\nBryan ASA:<\/p>\n

!ip sla monitor \r\nsla monitor 1 \r\ntype echo protocol ipIcmpEcho 192.168.1.1 interface P2P \r\nnum-packets 3 \r\nfrequency 10 \r\n!timer for monitor \r\nsla monitor schedule 1 life forever start-time now \r\n!attach tracker to monitor 11 track 1 rtr 1 reachability \r\n!route with ip sla tracker \r\nroute P2P 10.10.10.0 255.255.255.0 192.168.1.1 track 1 \r\n!backup route with a metric of 254 \r\nroute outside 10.10.10.0 255.255.255.0 1.1.1.1 254<\/code><\/pre>\n
Dallas ASA:<\/p>\n
!ip sla monitor \r\nsla monitor 1 \r\ntype echo protocol ipIcmpEcho 192.168.1.3 interface P2P \r\nnum-packets 3 05  frequency 10 \r\n!timer for monitor 08 sla monitor schedule 1 life forever start-time now \r\n!attach tracker to monitor \r\ntrack 1 rtr 1 reachability \r\n!route with ip sla tracker \r\nroute P2P 10.20.20.0 255.255.255.0 192.168.1.3 track 1 \r\n!backup route with a metric of 254 \r\nroute outside 10.20.20.0 255.255.255.0  2.2.2.2 254<\/code><\/pre>\n
So in the sample code you can see that our point to point link has the tracker attached. As long as the ping completes, this route is used. If the ping fails, the route with a metric of 254 is used.<\/p>\n
In the above example you would need to configure IP SLA in Bryan and in Dallas. This way they will both switch between the P2P and the Internet at the same time. Though, even if one lags behind in switch to the Internet connection, the tunnel will go ahead and establish since one side is attempting the connection.<\/p>\n","protected":false},"excerpt":{"rendered":"
It seems like everytime I want to do something funky with an ASA, Cisco says \u201cASAs are not routers, use them what they are\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,25,8],"tags":[],"class_list":["post-829","post","type-post","status-publish","format-standard","hentry","category-cisco","category-cisco-asa","category-networking"],"_links":{"self":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/829","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=829"}],"version-history":[{"count":4,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/829\/revisions"}],"predecessor-version":[{"id":834,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/829\/revisions\/834"}],"wp:attachment":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=829"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=829"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=829"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}