Web Server – Configuring Address with Two ISPs for Failover

Assuming a single context active/passive failover configuration with the ASAs connecting to the 2911s on unique subnets, you could trunk the links using two subinterfaces and vlan tagging. But the hack is to not have both subinterfaces active at the same time on a single ASA. On the ASA on the left assuming it's active, the first subint would be alive and the second down. After a failover event, the ASA on the right becomes active, and the first subint goes down and the second subint comes up.

Ideally, the ASAs share a common subnet with the LAN side of the 2911s precluding this hack; a L2 switch can sit between the ASAs and provide connectivity from any ASA to any 2911.

Only the relevant subinterfaces' config shown.

ASA

interface GigabitEthernet0/0
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/0.10
 vlan 10
 nameif Outside-ISP1
 security-level 0
 ip address 1.1.1.254 255.255.255.0
!
interface GigabitEthernet0/0.11
 vlan 11
 nameif Outside-ISP2
 security-level 0
 ip address 2.1.1.254 255.255.255.0

route Outside-ISP1 0.0.0.0 0.0.0.0 1.1.1.1 1
route Outside-ISP2 0.0.0.0 0.0.0.0 2.1.1.2 1

2911-ISP1

interface GigabitEthernet0/1
 description LAN
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0/1.10
 description LAN-ISP1
 encapsulation dot1Q 10
 ip vrf forwarding vpn
 ip address 1.1.1.1 255.255.255.0
!
interface GigabitEthernet0/1.11
 description LAN-ISP2
 encapsulation dot1Q 11
 ip address 2.1.1.1 255.255.255.0
 shutdown

2911-ISP2

interface GigabitEthernet0/1
 description LAN
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0/1.10
 description LAN-ISP1
 encapsulation dot1Q 10
 ip address 1.1.1.2 255.255.255.0
 shutdown
!
interface GigabitEthernet0/1.11
 description LAN-ISP2
 encapsulation dot1Q 11
 ip address 2.1.1.2 255.255.255.0

DynDNS

Using DynDNS is not a viable solution for your usecase since its primary use case is mapping a dynamic ip address to a dns record. If you have two Upstreams with different ip subnets you would need to edit ip address or nat confiuration on failure which could be scripted but is prone to error.

GSLB

Another way of using DNS would be GSLB, which utilizes DNS to load balance and use a keep alive method to check for availability. Since DNS is bound to TTL you will always encounter a certain downtime since clients will cache the ip address to fqdn mapping and it will need to time out so it might be the wrong solution for you.

BGP

Using BGP to solve the problem would be the optimal solution. You would have an AS and your own ip address range which you advertise to both providers. If you encounter issues with one provider the peering between your local router and your isp would time out and traffic will automagically be routed to your other provider (I will not get to technical, there is still more to it)

Considering Complexity... BGP is not complex to set-up in this scenario. You would still need an experienced network engineer to ensure best-practice configuration but your scenario does not require much BGP knowledge.

Considering Cost... Annual costs for AFRINIC & additional costs of ISP peering with you. You would need router(s) to be BGP capable but nowadays there are even small HP/Cisco/YouNameIt routers that are capable of BGP...heck even Sophos UTM is BGP capable. :)

Hope I could help... I tried to be generic and not go too much into the details, drop me a note if you need to know more.