This is quite a complicated one using quite a well-developed network infrastructure. I'm tearing my hair out trying to find, what I thought would be, quite a simple solutions. Perhaps BudMan can help.
We have a network architecture as follows in this amazing diagram. To the left is one physical site, to the right is the other. They are connected via two 1Gb routed links, though these could become switched links if necessary. Note that the two 'DMZs' at the bottom is a mistake. These should be regular client VLANs.
All I want to do is find a way to use the other site's Internet connection, if the Internet connection at one of the sites goes down. In theory it seems pretty simple, but whenever I explore a method I end up hitting a brick wall. We are running EIGRP between the core switches and several other devices and remote sites not shown on the diagram. Unfortunately, the majority of the DMZ VLANs (and there are at lot of them) are statically routed.
Here's what I've tried so far:
a) Set up a floating gateway on the core switch (which is the default gateway for client VLANs) - This method won't work as hosts in the DMZs don't route through the core switch. DMZ hosts would still lose Internet access.
b) Connect a spare ASA interface back to the core switch - Our Network Security Manager doesn't approve of this, since client VLANs (which also hold our most secure data) are then only protected from the outside world by one firewall.
c) Connect a spare ASA interface into a new VLAN protected by the FWSM - I just can't see how that would work. The FWSM would then just forward traffic back to the ASA in a loop, unless some kind of route-map were applied. The route-map would presumably have to applied on the core switch and apply to the incoming interface. At this point I get a little lost. I'm not even sure what I would set the 'next-hop IP' to.
d) Have all devices participate in EIGRP and redistribute a static route from the ASAs into the network - To be honest, I haven't explored this in detail and although I think it's feasible, I get a little lost in deciding exactly what should be set up.
I know I've left out a lot of technical detail but I'm happy to fill in the blanks where required. Any advice would be appreciated.