Cisco – Multiple ISPs failover configuration

I have been migrating sites away from policy-based VPNs for just this reason. Policy-based VPNs are too unpredictable when it comes to failover behavior. I much prefer route-based IPsec tunnels, either point-to-point or DMVPN. Unfortunately, to my knowledge the ASA platform still doesn't support route-based tunnels.

As long as both interfaces have public IP addresses, which it sounds like, you have two options:

1) IP SLA: outbound traffic will only use one interface at a time.

Essentially, you configure a static default route out the primary interface, which is tracked and a static default route out the secondary interface. If the tracking finds an issue, the tracked route is removed, making the default route out the secondary interface

IP SLA link

R1(config)# ip sla 1
R1(config)# icmp-echo $primaryNextHop source-interface $primaryInterface
R1(config)# timeout 1000
R1(config)# threshold 2
R1(config)# frequency 3
R1(config)# ip sla schedule 1 life forever start-time now
R1(config)# track 1 ip sla 1 reachability
R1(config)# ip route 0.0.0.0 0.0.0.0 $primaryNextHop track 1
R1(config)# ip route 0.0.0.0 0.0.0.0 $secondaryNextHop 10

2) BGP peer with ISPs: this can be configured to allow traffic outbound on both interfaces at the same time. You can also set this up to allow ISP1 to receive traffic for the secondary interface and vice versa (BGP Multihoming)