Configure Dual ISP Failover for FTD Managed by FMC

Available Languages

Download Options

  • PDF     (587.0 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (641.5 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (568.0 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:May 16, 2024
Document ID:220636

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    This document describes how to configure DUAL ISP Failover with PBR and IP SLAs on an FTD that is managed by FMC.

    Prerequisites

    Requirements

    Cisco recommends that you have knowledge of these topics:

    • Policy Based Routing (PBR)
    • Internet protocol service level agreement (IP SLA)
    • Firepower Management Center (FMC)
    • Firepower Threat Defense (FTD)

    Components Used

    The information in this document is based on these software and hardware versions:

    • FMCv 7.3.0
    • FTDv 7.3.0

    The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

    Background Information

    Static Route Tracking Feature Overview

    Static Route Tracking feature allows the FTD to use a connection to a secondary ISP in the event that the primary leased line becomes unavailable. In order to achieve this redundancy, the FTD associates a static route with a monitoring target that you define. The SSLA operation monitors the target with periodic ICMP echo requests.

    If an echo reply is not received, then the object is considered down, and the associated route is removed from the routing table. A previously configured backup route is used in place of the route that is removed. While the backup route is in use, the SLA monitor operation continues its attempts to reach the monitoring target.

    Once the target is available again, the first route is replaced in the routing table, and the backup route is removed.

    You can now configure multiple next-hops and policy-based routing forwarding actions at the same time. When traffic matches the criteria for the route, the system attempts to forward traffic to the IP addresses in the order you specify, until it succeeds.

    The feature is available on FTD devices running version 7.1 and later managed by an FMC version 7.3 and later. 

    Configure

    Network Diagram

    This image provides an example of a network diagram.

    Diagram ExampleImage 1. Diagram example.

    ISP1 = 10.115.117.1

    ISP2 = 172.20.20.13

    Configurations

    Step 1. Configure the SLA Monitor objects.

    On the FMC, navigate to Object > Object Management > SLA Monitor > Add SLA Monitor and add an SLA Monitor object for the ISP IP addresses.

    SLA monitor for the primary default gateway (ISP1).

    SLA1 Monitor Configuration WindowImage 2. SLA1 monitor configuration window.

    SLA monitor for the secondary default gateway (ISP2).

    SLA2 Monitor Configuration WindowImage 3. SLA2 monitor configuration window.

    Step 2. Configure the Static Routes with Route Track.

    On the FMC, navigate to Device > Device Management > Edit the desired FTD > Routing > Static Routes, and add the statics routes with the correct SLA monitor. 

    The SLA monitor must be the one which monitors the default gateway.

    Static route for the primary default gateway:

    Static Route Configuration Window for the Outside InterfaceImage 4. Static route configuration window for the Outside interface.

    Static route for the secondary default gateway.

    Static Route Configuration Window for the Backup InterfaceImage 5. Static route configuration window for the Backup interface.

    Step 3. Configure the Policy Base Routes. 

    Navigate to Device > Device Management > Edit the desired FTD > Routing > Policy Based Routing, add the PBR, and choose the ingress interface.

    PBR Configuration WindowImage 6. PBR configuration window.

    Configure the forwarding actions.

    • Choose or add a new access control list that you want to match.
    • ChooseIP Address from the Send to option. 
    • In this example, 10.115.117.234 is the FTD outside IP address. 

    Forwarding Actions Configuration WindowImage 7. Forwarding Actions configuration window.

    Scroll down and add the Verify Availability  values for ISP1.

    Forwarding Actions Configuration WindowImage 8. Forwarding Actions configuration window.

    Repeat the same process for the backup interface. However, ensure to use a different access control list object. 

    Forwarding Actions Configuration WindowImage 9. Forwarding Actions configuration window

    Repeat the same process for theVerify Availabilityconfiguration but now for ISP2. 

    Verify Availability ConfigurationImage 10.Verify Availability configuraiton.

    Validate your configuration.

    PBR ConfigurationImage 11. PBR configuration.

    Verify

    Access the FTD through Secure Shell (SSH) and use the command system support disagnotsic-cli and run these commands:

    • show route-map: This command displays the route-map configuration.

    firepower# show route-map 

    route-map FMC_GENERATED_PBR_1679065711925, permit, sequence 5
    Match clauses:
    ip address (access-lists): internal_networks

    Set clauses:
    ip next-hop verify-availability 10.115.117.1 1 track 1 [up]
    ip next-hop 10.115.117.234
    route-map FMC_GENERATED_PBR_1679065711925, permit, sequence 10
    Match clauses:
    ip address (access-lists): all_ipv4_for_pbr

    Set clauses:
    ip next-hop verify-availability 172.20.20.13 2 track 2 [up]
    ip next-hop 172.20.20.77
    firepower#
    • show running-config sla monitor: This command displays the SLA configuration.
    firepower# show running-config sla monitor 
    sla monitor 1
    type echo protocol ipIcmpEcho 10.115.117.1 interface outside
    sla monitor schedule 1 life forever start-time now
    sla monitor 2
    type echo protocol ipIcmpEcho 172.20.20.13 interface backup
    sla monitor schedule 2 life forever start-time now
    firepower#
    • show sla monitor configuration: This command displays the SLA configuration values.
    firepower# show sla monitor configuration 
    SA Agent, Infrastructure Engine-II
    Entry number: 1
    Owner: 
    Tag: 
    Type of operation to perform: echo
    Target address: 10.115.117.1
    Interface: outside
    Number of packets: 1
    Request size (ARR data portion): 28
    Operation timeout (milliseconds): 5000
    Type Of Service parameters: 0x0
    Verify data: No
    Operation frequency (seconds): 60
    Next Scheduled Start Time: Start Time already passed
    Group Scheduled : FALSE
    Life (seconds): Forever
    Entry Ageout (seconds): never
    Recurring (Starting Everyday): FALSE
    Status of entry (SNMP RowStatus): Active
    Enhanced History:

    Entry number: 2
    Owner: 
    Tag: 
    Type of operation to perform: echo
    Target address: 172.20.20.13
    Interface: backup
    Number of packets: 1
    Request size (ARR data portion): 28
    Operation timeout (milliseconds): 5000
    Type Of Service parameters: 0x0
    Verify data: No
    Operation frequency (seconds): 60
    Next Scheduled Start Time: Start Time already passed
    Group Scheduled : FALSE
    Life (seconds): Forever
    Entry Ageout (seconds): never
    Recurring (Starting Everyday): FALSE
    Status of entry (SNMP RowStatus): Active
    Enhanced History:
    • show sla monitor operational-state: This command displays the operational state of the SLA operation.
    firepower# show sla monitor operational-state 
    Entry number: 1
    Modification time: 15:48:04.332 UTC Fri Mar 17 2023
    Number of Octets Used by this Entry: 2056
    Number of operations attempted: 74
    Number of operations skipped: 0
    Current seconds left in Life: Forever
    Operational state of entry: Active
    Last time this entry was reset: Never
    Connection loss occurred: FALSE
    Timeout occurred: FALSE
    Over thresholds occurred: FALSE
    Latest RTT (milliseconds): 1
    Latest operation start time: 17:01:04.334 UTC Fri Mar 17 2023
    Latest operation return code: OK
    RTT Values:
    RTTAvg: 1 RTTMin: 1 RTTMax: 1
    NumOfRTT: 1 RTTSum: 1 RTTSum2: 1

    Entry number: 2
    Modification time: 15:48:04.335 UTC Fri Mar 17 2023
    Number of Octets Used by this Entry: 2056
    Number of operations attempted: 74
    Number of operations skipped: 0
    Current seconds left in Life: Forever
    Operational state of entry: Active
    Last time this entry was reset: Never
    Connection loss occurred: FALSE
    Timeout occurred: FALSE
    Over thresholds occurred: FALSE
    Latest RTT (milliseconds): 1
    Latest operation start time: 17:01:04.337 UTC Fri Mar 17 2023
    Latest operation return code: OK
    RTT Values:
    RTTAvg: 1 RTTMin: 1 RTTMax: 1
    NumOfRTT: 1 RTTSum: 1 RTTSum2: 1
    • show track: This command displays the information about objects tracked by the SLA Track process.
    firepower# show track 
    Track 1
    Response Time Reporter 1 reachability
    Reachability is Up
    4 changes, last change 00:53:42
    Latest operation return code: OK
    Latest RTT (millisecs) 1
    Tracked by:
    ROUTE-MAP 0
    STATIC-IP-ROUTING 0
    Track 2
    Response Time Reporter 2 reachability
    Reachability is Up
    2 changes, last change 01:13:41
    Latest operation return code: OK
    Latest RTT (millisecs) 1
    Tracked by:
    ROUTE-MAP 0
    STATIC-IP-ROUTING 0
    • show running-config route: This command displays the current route configuration.
    firepower# show running-config route
    route outside 0.0.0.0 0.0.0.0 10.115.117.1 1 track 1
    route backup 0.0.0.0 0.0.0.0 172.20.20.13 254 track 2
    route vlan2816 10.42.0.37 255.255.255.255 10.43.0.1 254
    firepower#
    • show route: This command displays the routing table for the data interfaces.

    firepower# show route

    Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
    D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
    N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
    E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
    i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
    ia - IS-IS inter area, * - candidate default, U - per-user static route
    o - ODR, P - periodic downloaded static route, + - replicated route
    SI - Static InterVRF, BI - BGP InterVRF
    Gateway of last resort is 10.115.117.1 to network 0.0.0.0

    S* 0.0.0.0 0.0.0.0 [1/0] via 10.115.117.1, outside
    S 10.0.0.0 255.0.0.0 [1/0] via 10.88.243.1, backbone
    C 10.88.243.0 255.255.255.0 is directly connected, backbone
    L 10.88.243.67 255.255.255.255 is directly connected, backbone
    C 10.115.117.0 255.255.255.0 is directly connected, outside
    L 10.115.117.234 255.255.255.255 is directly connected, outside
    C 10.42.0.0 255.255.255.0 is directly connected, vlan2816
    L 10.42.0.1 255.255.255.255 is directly connected, vlan2816
    S 10.42.0.37 255.255.255.255 [254/0] via 10.43.0.1, vlan2816
    C 172.20.20.0 255.255.255.0 is directly connected, backup
    L 172.20.20.77 255.255.255.255 is directly connected, backup

    When the primary link fails:

    • show route-map: This command displays the route-map configuration when a link fails.

    firepower# show route-map FMC_GENERATED_PBR_1679065711925

    route-map FMC_GENERATED_PBR_1679065711925, permit, sequence 5
    Match clauses:
    ip address (access-lists): internal_networks

    Set clauses:
    ip next-hop verify-availability 10.115.117.1 1 track 1 [down]
    ip next-hop 10.115.117.234
    route-map FMC_GENERATED_PBR_1679065711925, permit, sequence 10
    Match clauses:
    ip address (access-lists): all_ipv4_for_pbr

    Set clauses:
    ip next-hop verify-availability 172.20.20.13 2 track 2 [up]
    ip next-hop 172.20.20.77
    firepower#
    • show route: This command displays the new routing table per interface.
    firepower# show route

    Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
    D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
    N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
    E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
    i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
    ia - IS-IS inter area, * - candidate default, U - per-user static route
    o - ODR, P - periodic downloaded static route, + - replicated route
    SI - Static InterVRF, BI - BGP InterVRF
    Gateway of last resort is 10.115.117.1 to network 0.0.0.0

    S* 0.0.0.0 0.0.0.0 [1/0] via 172.20.20.13, backup
    S 10.0.0.0 255.0.0.0 [1/0] via 10.88.243.1, backbone
    C 10.88.243.0 255.255.255.0 is directly connected, backbone
    L 10.88.243.67 255.255.255.255 is directly connected, backbone
    C 10.115.117.0 255.255.255.0 is directly connected, outside
    L 10.115.117.234 255.255.255.255 is directly connected, outside
    C 10.42.0.0 255.255.255.0 is directly connected, vlan2816
    L 10.42.0.1 255.255.255.255 is directly connected, vlan2816
    S 10.42.0.37 255.255.255.255 [254/0] via 10.43.0.1, vlan2816
    C 172.20.20.0 255.255.255.0 is directly connected, backup
    L 172.20.20.77 255.255.255.255 is directly connected, backup

    Related Information

    Revision History

    Revision Publish Date Comments
    3.0
    16-May-2024
    Initial Release
    1.0
    26-Jul-2023
    Initial Release
    TAC Authored

    Contributed by Cisco Engineers

    • Leonel Matus Climaco
      Cisco TAC Engineer
    • Oscar Montoya Torres
      Cisco TAC Engineer

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products