CloudLabBox
Try the free demo

Cisco ASA lab 6 of 15

Routing on the ASA: authenticated OSPF, dual ISPs and SLA-tracked default routes

Run OSPF with MD5 authentication between HQ-FW and the core router, add a second ISP, and make the default route fail over automatically when an SLA probe through ISP1 stops answering, with PAT on both ISP links.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 4,096 MB in total. That fits the free demo too.

In your workspace: Shared, then Cisco ASA Firewall SCOR 350-701 guided labs, then 06 - Routing on the ASA - authenticated OSPF dual ISPs and SLA-tracked default routes

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 75 minutes
Nodes need
5 vCPU, 4,096 MB
Smallest plan
Lite

The scenario

Kestrel HQ has grown: a core router (CORE) now sits behind HQ-FW with the staff and server VLANs, and a second internet line from ISP2 has been installed on Gi0/2. Management wants:

  1. HQ-FW to learn the internal VLANs dynamically from CORE with OSPF area 0, authenticated with MD5 key 1 Kestrel-OSPF-26, and to give CORE its default route through OSPF.
  2. ISP1 to stay the primary internet path, and ISP2 to take over automatically when ISP1 stops forwarding, even if HQ-FW's own link to ISP1 stays up.
  3. Internet access to work through both ISPs with interface PAT.
ItemValue
Gi0/2name outside2, security level 0, 100.64.20.2/24, gateway 100.64.20.1
OSPFprocess 1, router ID 10.255.255.1, area 0 on 10.10.10.0/24
SLA probeICMP echo to 198.18.1.2 (ISP1's upstream neighbour) out of outside, every 5 seconds

What you’ll practise

  • Configure OSPF on the ASA with MD5 authentication and originate a default route
  • Add a second outside interface and a floating static default route
  • Track reachability through ISP1 with an SLA monitor and a tracked static route
  • Configure PAT on both ISP interfaces
  • Test the failover and read show track, show route and show xlate

The tasks

  1. OSPF with CORE
  2. The default route for CORE
  3. The second ISP
  4. SLA-tracked primary, floating backup
  5. Test the failover

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Routing on the ASA - authenticated OSPF dual ISPs and SLA-tracked default routes5 nodes, 5 links. Every link is listed as text below the diagram.HQ-FWCOREISP1ISP2NETGi0/0Gi0/0Gi0/1Gi0/0Gi0/1Gi0/1Gi0/1Gi0/0Gi0/2Gi0/0
5 nodes, with the interface names each link uses.
Every link, as text
  • HQ-FW Gi0/0 to CORE Gi0/0
  • HQ-FW Gi0/1 to ISP1 Gi0/0
  • HQ-FW Gi0/2 to ISP2 Gi0/0
  • ISP1 Gi0/1 to NET Gi0/0
  • ISP2 Gi0/1 to NET Gi0/1
Nodes in Routing on the ASA: authenticated OSPF, dual ISPs and SLA-tracked default routes, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQ-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
CORECisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
ISP1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
ISP2Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
NETCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco ASA Firewall SCOR 350-701 guided labs.

  3. Open 06 - Routing on the ASA - authenticated OSPF dual ISPs and SLA-tracked default routes and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco ASA labs

All Cisco ASA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.