topic Source interface based routing in Network Security

Source interface based routing

richyvrlimited — Thu, 08 Jun 2023 11:54:26 GMT

Pretty sure this isn't possible, but worth an ask.

I'd like to policy route some of our traffic based on application awareness. This is all being done by a Sophos XG and then routed via an alternate link to an ASA which is one of our internet /AnyConnect gateways.

As the ASA already has static routes inside for addresses any traffic the Sophos XG policy routes to the ASA is sent back via it's inside interface causing asymmetric routing.

I can fix this by NAT'ing outbound traffic that's been policy routed on the XG, however I can only do the NAT based on source/destination IP, not application awareness

Other than re-architecting the network, can I policy route traffic on the ASA so if the traffic was originally sourced from a specific interface then return traffic would be routed via this interface?

Cheers

Re: Source interface based routing

Flavio Miranda — Thu, 08 Jun 2023 12:45:21 GMT

Policy based routing is supported on ASA from version 9.4.1.

https://www.networkstraining.com/cisco-asa-policy-based-routing-pbr/

Re: Source interface based routing

richyvrlimited — Thu, 08 Jun 2023 13:20:38 GMT

Not really what I asked. I know I can policy route based on source address. What I want to do is policy route based on the original source interface of the connection.