topic Re: asa reverse path check and policy routing in Network Security

asa reverse path check and policy routing

DraganSkundric87318 — Tue, 27 Jun 2023 11:14:39 GMT

imagine basic asa setup with two outside interfaces, two providers, and one inside interface. I have route map that route traffic from one inside ip to provider 2 and default route to provider 1. If I implement reverse path check, asa uses routing table as reference point and I have problem with traffic from provider 2. Is there a solution to this that is implementable on asa?

Re: asa reverse path check and policy routing

tvotna — Tue, 27 Jun 2023 12:31:04 GMT

You should not configure uRPF on ASA on those outside interfaces, because uRPF doesn't make any sense in this scenario. Both outside interfaces can be used to access any Internet IP address, hence traffic from any IP address can come back through both of the interfaces. In a certain sense this is equivalent to two default routes, so uRPF doesn't add any value here.

Re: asa reverse path check and policy routing

MHM Cisco World — Tue, 27 Jun 2023 13:12:27 GMT

you have asymmetric routing that why uRPF is drop packet

Re: asa reverse path check and policy routing

DraganSkundric87318 — Tue, 27 Jun 2023 13:13:56 GMT

i know about reason. just wanted to know if there is a way for asa urpf to be aware of pbr and see this as legitimate setup

Re: asa reverse path check and policy routing

MHM Cisco World — Tue, 27 Jun 2023 13:24:45 GMT

if you use ECMP then I think this issue will solve

Re: asa reverse path check and policy routing

tvotna — Tue, 27 Jun 2023 14:01:43 GMT

Theoretically, PBR could mark flow to exempt returning packets from uRPF check, but this has never been implemented.

HTH

Re: asa reverse path check and policy routing

MHM Cisco World — Tue, 27 Jun 2023 14:03:45 GMT

Can you check NAT' if the traffic not NATing correctly then this can lead to asymmetric.

Re: asa reverse path check and policy routing

Aref Alsouqi — Tue, 27 Jun 2023 15:24:47 GMT

I don't believe there is a fix for that, however, if you want to send the traffic from a specific endpoint on the inside out of provider 2 why not to create a NAT rule for that specific endpoint and map it to the ASA interface connected to provider 2?

Re: asa reverse path check and policy routing

DraganSkundric87318 — Wed, 28 Jun 2023 06:01:45 GMT

but urpf will still see return traffic from internet IPs on interface 2 while routing table has route for them on interface 1 and reverse deny this traffic ... I guess

Re: asa reverse path check and policy routing

MHM Cisco World — Wed, 28 Jun 2023 09:08:05 GMT

I think he use FW behind Edge router and Edge router doing NATing, and I am with you NATing can solve issue here,
instead of NATing only in edge router he can NATing to link between FW and Edge router and in Edge router he can NATing again from private to public.
I ask him about NATing let see his answer

Re: asa reverse path check and policy routing

MHM Cisco World — Wed, 28 Jun 2023 09:46:22 GMT

No NATing is workaround that solve your issue'

The edge router without NATing

Have route to FW inside via two path and it select one that make urpf drop packet in FW

If we NATing then edge router will send traffic to direct connect link and hence the FW recieve traffic in correct OUTside interface and urpf not drop traffic

Re: asa reverse path check and policy routing

DraganSkundric87318 — Wed, 28 Jun 2023 09:36:47 GMT

i have edge routers toward both providers where I am doing NAT. ok, there is work arround to connect both providers to same asa interface and do some chemistry there and move urpf/async path from asa

Re: asa reverse path check and policy routing

MHM Cisco World — Wed, 28 Jun 2023 09:48:23 GMT

The issue not edge router with ISP

The isse is FW and edge router'

If we NATing in FW this make edge router forward traffic to correct direct connect link.

Re: asa reverse path check and policy routing

Aref Alsouqi — Wed, 28 Jun 2023 09:57:04 GMT

Alternatively, you can just remove the uRPF from the firewalls and configure an access list on the edge routers interfaces that are facing the ISPs to deny the incoming RFC1918 ranges allowing everything else. That will drop any private IP addresses in inbound and it won't affect VPN as the VPN traffic would be encrypted when it passes through the edge routers.

Re: asa reverse path check and policy routing

ajwallace — Wed, 08 Jan 2025 16:01:42 GMT

Did you try traffic zones? I believe that is one of the purposes of traffic zones but I could be wrong.