topic Re: Redirect Specific Users to user specific WAN interface? in Network Security

Redirect Specific Users to user specific WAN interface?

ipv6x — Fri, 14 Oct 2022 09:56:00 GMT

Hello,

I am trying to force some users to send traffic to specific wan interface.

Created a ACL:

ALLOW inside_zone specific_users ---> outside_zone interface_WAN3

in NAT

dynamic NAT from inside to outside WAN3 interface.

But when i try to see from users if they use wan3 they go out from wan 1 interface.

Any ideas?

Thnx

Re: Redirect Specific Users to user specific WAN interface?

balaji.bandi — Fri, 14 Oct 2022 09:59:23 GMT

Either you need to some static route or PBR for that IP to go to use different gateway than default.

Re: Redirect Specific Users to user specific WAN interface?

ipv6x — Fri, 14 Oct 2022 10:25:03 GMT

yes it's also static route:

192.168.100.141 255.255.255.255 2.9.8.161

But he's go from wan 1...

Re: Redirect Specific Users to user specific WAN interface?

MHM Cisco World — Fri, 14 Oct 2022 10:47:27 GMT

the static route use for destination not for source of packet,
the only solution here to override the RIB here is using PBR.

ip access-list extended 100
permit ip <user> any
!
route-map WAN3 permit 10
match ip address 100
set <WAN3>

Re: Redirect Specific Users to user specific WAN interface?

ipv6x — Fri, 14 Oct 2022 10:55:35 GMT

@MHM Cisco World in flexconfig is any possibility to configure that?

Re: Redirect Specific Users to user specific WAN interface?

MHM Cisco World — Fri, 14 Oct 2022 10:56:40 GMT

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/217588-configure-pbr-with-ip-slas-for-dual-isp.html

Re: Redirect Specific Users to user specific WAN interface?

ipv6x — Fri, 14 Oct 2022 10:59:34 GMT

that is if you are using FMC, but i am using FDM

Re: Redirect Specific Users to user specific WAN interface?

balaji.bandi — Fri, 14 Oct 2022 12:01:08 GMT

Then you need to use PBR, FTD you need to do flexconfig.

OLD FDM do not support Flexconfig option, what FTD code running ?

Re: Redirect Specific Users to user specific WAN interface?

ipv6x — Fri, 14 Oct 2022 12:18:47 GMT

i am runnig 7.0.3 version of FTD/Firepower1140

Re: Redirect Specific Users to user specific WAN interface?

MHM Cisco World — Fri, 14 Oct 2022 12:23:23 GMT

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/fdm/fptd-fdm-config-guide-660/fptd-fdm-routing.html

Re: Redirect Specific Users to user specific WAN interface?

ipv6x — Fri, 14 Oct 2022 12:57:28 GMT

access-list to_wan3; 1 elements; name hash: 0x96895f8d
access-list to_wan3 line 1 extended permit ip host 192.168.100.141 any4 log default
(hitcnt=0) 0x632e27c6
> show route-map
route-map map_to_wan3, permit, sequence 10
Match clauses:
ip address (access-lists): to_wan3
interface outside_wan3

the configuration but again is not working

Re: Redirect Specific Users to user specific WAN interface?

balaji.bandi — Fri, 14 Oct 2022 13:19:37 GMT

latest code should be able to use flexconfig

Re: Redirect Specific Users to user specific WAN interface?

MHM Cisco World — Fri, 14 Oct 2022 14:57:35 GMT

only clear the xlate and conn (which was lead to WAN1) and it will work.