AAA server on ASA - Asynchronous Routing

Matthew burnley — Mon, 11 Mar 2019 06:11:19 GMT

Hi Guys,

Wondering if anyone can help me. I have an ASA setup with an AAA server to authenticate users authenticating with the ASA, the RADIUS server is located off the ASA on another network and to get to it the AAA server it routes the request out the access interface. The issue is that we have put in a leasedline which now acts as the primary route to get to the AAA server, so i have had to manually change the interface which the AAA request is sourced from and also change a route back on the router which hosts the AAA server to avoid asynchronous routing.

Obviously there re now 2 paths to get to the AAA server and i have to manually set an outgoing interface against one of them, so if the primary link fails and the request is sourced from the primary interface but is routed out the backup, then the ASA will drop the packet when it comes back.

I can only add one server within an AAA group with the same IP as i was going to add 2 servers with the same ip with two different outgoing interfaces but it does not work.

Is there a way to get this to work? maybe turn off asynchronous routing somehow just for this AAA server?

Could anybody tell me how i can get this to work?

Thanks!

Hi Matt , You can try to

rvarelac — Tue, 27 Oct 2015 05:21:18 GMT

Hi Matt ,

You can try to apply a TCP-bypass to this traffic to allow the AAA server reply in a different ASa interface where it was sourced.

Check examples below

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/conns_tcpstatebypass.html

Hope it helps

-Randy-

Hi Randy, I'll have to give

Matthew burnley — Tue, 27 Oct 2015 23:17:09 GMT

Hi Randy,

I'll have to give the TCP bypass a go.

What happens if i create two AAA groups and put the same server IP in each group but specify different outgoing interfaces for the server?

topic AAA server on ASA - Asynchronous Routing in Network Access Control

AAA server on ASA - Asynchronous Routing

Hi Matt , You can try to

Hi Randy, I'll have to give