ASA SLA Tracking w/ multiple icmp checks

Question

I would like to setup a backup internet connection but I don't want the connection to failover if one IP address or sla monitor is down.  I would like at least two to fail before it goes down. The only way I can think of is the config below.  Is there an easier way?
route ouside 0.0.0.0 0.0.0.0 <isp1 route> 1 track 1
route ouside 0.0.0.0 0.0.0.0 <isp1 route> 2 track 2
route outside 0.0.0.0 0.0.0.0 <isp2 route> 254
sla monitor 101
   type echo protocol ipIcmpEcho 10.0.0.1 interface outside
   num-packets 3
   frequency 10
sla monitor 102
  type echo protocol ipIcmpEcho 10.0.0.2 interface outside
  num-packets 3
  frequency 10
sla monitor schedule 101 life forever start-time now
sla monitor schedule 102 life forever start-time now
track 1 rtr 101 reachability
track 2 rtr 102 reachability

Answer 1

Hey, I know I am late, but I had found your article earlier today looking for an answer for a very similar issue. The problem I see with your solution is that the second route will overwrite the first line. Your cannot have two routes for the same network and same next-hop in a Cisco ASA. My problem was slightly different than yours, as I have a single ISP behind the ASA, but wanted to using multiple SLA monitors for the default-route so it is in the routing table if any SLA is up. The default is being redistributed into EIGRP.
Her is my solution, I hope this will help someone, someday. It is not nice and short as we would like them, but works perfectly for what I needed. I tried to put enough comments so that you understand some choices I had to make.
WAIT!  Did I tell you what follows doesn't look nice? This is for trained professionals only. Make sure you have a deep understanding of IP routing, IP routing protocols and route redistribution before you use this ! Use at your own risks!
OK her it goes...
! Monitoring a single hosts in unsufficient in many production environments.
! Very limited IP SLA tracking in ASA doesn't really allow to monitor multiple hosts at the same time.
! Only one monitor process per track process and no configurable delays for down or up events
! This will show how to create dummy default-routes each bound to a different SLA monitor for distribution into EIGRP, such that a default-route will exist in the routing table if any of the monitored hosts is responding and how to filter redistribution of static routes into EIGRP
! The actual routes the ASA will use are 0.0.0.0/1 and 128.0.0.0/1, but those routes will only be used locally by the ASA, because they are a longer-match than the 0.0.0.0/0
! The most difficult part is preventing the 0.0.0.0/1 routes from getting redistributed in EIGRP along with the 0.0.0.0/0 route.
! The same technique could be applied for RIP or OSPF
! ISP router (default gateway)
name x.x.x.x ISPrtr
! Google DNS
name y.y.y.y SLAtesthost1
! Another host on the Internet
name z.z.z.z SLAtesthost2
! Some unused/invalid hosts in the inside interface's subnet, I always use a /28 or bigger subnets so it was easy to find usused host addresses in the subnet
name a.a.a.a invalid-host1
name a.a.a.b invalid-host2
sla monitor 1
type echo protocol ipIcmpEcho SLAtesthost1 interface outside
threshold 500
frequency 10
packets 3
sla monitor schedule 1 life forever start-time now
sla monitor 2
type echo protocol ipIcmpEcho SLAtesthost2 interface outside
threshold 500
frequency 10
packets 3
sla monitor schedule 2 life forever start-time now
track 1 rtr 1 reachability
track 2 rtr 2 reachability
! Split the default route in two routes, these will be used by the ASA(longer-match) to forward IP packets to the ISP router. It is EXTREMELY IMPORTANT that these two routes are NOT redistributed into any routing protocol if you rely of the default-route elsewhere on your network. The route-map redist-default below will achieve this, and allow only default
route outside 0.0.0.0 128.0.0.0 255.255.255.255 ISPrtr
route outside 128.0.0.0 128.0.0.0 255.255.255.255 ISPrtr
! Create two dummy routes, each bound to its own tracking object/SLA monitor, which won't be used to forward any traffic. They can point to hosts in the inside subnet. We use different and invalid hosts as the next hops (other than the ISP router). First because the same route/same nex-hop cannot coexist in the ASA configuration, secondly because the ISP router's address will be used in a route-map to block the previous 2 routes (split).
route inside 0.0.0.0 0.0.0.0 invalid-host1 track 1
route inside 0.0.0.0 0.0.0.0 invalid-host2 track 2
access-list deny-all-routes permit host 0.0.0.0
access-list default-route permit host 0.0.0.0
access-list ISP-router permit host ISPrtr
! The following route-map will ensure only a dummy default route is redistributed in EIGRP, we must absolutely blocck two split routes (0.0.0.0/1 and 128.0.0.0/1)
! Since ASA does not support extended ACL in route-map for filtering on the mask, the first route-map statement denies any route with the real ISP router as the next-hop
! The same route-map could be used for redistributing into RIPv2 or OSPF
route-map redist-default deny 10
match ip next-hop ISP-router
route-map redist-default permit 20
match ip address default-route
route-map redist-default deny 100
router eigrp 100
no auto-summary
! Block all inbound route in the ASA
distribute-list deny-all-routes in interface inside
! Allow only the default-route to be advertised toward inside peers
distribute-list default-route out interface inside
! Redistribute only the default-route, adjust metrics to your needs
redistribute static metric 10000 100 255 1 1500 route-map redist-default
passive-interface default
no passive-interface inside
network
Thanks,
Marc-André