up vote 1 down vote favorite
share [g+] share [fb]

We currently have an ASA5505 and are getting a 2nd ISP (both ISPs will have 20 up/down dedicated fiber).

We need to be able to setup BGP/Multi-homing but I have found that the ASA's do not support this. This is due to the fact that they are more firewalls (with the NAT ability) then a router.

What sort of hardware are we going to require for this functionality? We will require two of them to be able to be configured as a failover pair.

Currently, both of our ASA's have Security+ and are set as a failover array.

link|improve this question
85% accept rate
This is very borderline shopping. We can't tell you which ones are the best value for money or their prices, because we don't know where you are or what sort of a deal you can get, and we're a global site and our local pricing may not reflect yours. I will attempt to remove the shopping portion of the question so it stands a better change of survival. – Mark Henderson♦ Nov 1 '11 at 22:34
Are you multihoming with a single IP block between the providers? Thus you have an AS number and PI address space of suitable size to reduce the chances being filtered -- a /24 or larger? Or are you planning on using two ISP's each with a separate public IP block? Makes quite a bit of difference on how to move forward and keep the ASA's. – Weaver Nov 3 '11 at 5:56
feedback

2 Answers

up vote 1 down vote accepted

You have a few choices. One possibility is just to put two cheap PCs in front of the ASA5505s. One PC would act as your 'border router' to each ISP and run BGP both with the other 'border router' and with that ISP. You would then have your own ISP network coming out of the border routers, which you could connect your firewalls to.

You can use whatever OS or platform for the PCs you are comfortable with. OpenBSD, FreeBSD, Linux, or router-specific distributions all exceptionally work well at 100Mbps or less.

link|improve this answer
Thanks for the advice! I will look into both routes and get this setup. I know Fedora 15 has a lot of awesome features for this (^_^) – Lbaker101 Nov 2 '11 at 15:39
feedback
up vote 0 down vote

My businesses specializes in bringing open source to small businesses, so the following is how we would do it:

One idea for fail-over is to use pfSense setup with CARP and pfsync to provide a seamless dual router fail-over deployment, but thats just me... The reason why I would use pfSense over straight OpenBSD, is that pfSense has a commercial entity providing dedicated support.

I believe pfSense also supports multi-homing...

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.