topic Re: Policy Based Routing for IPSec VPN in Network Security

Policy Based Routing for IPSec VPN

tyler.perkey — Fri, 21 Feb 2020 16:09:30 GMT

Hi all,

I wanted to know if it was possible to used a PBR on an ASA for IPSec VPN tunnels. I have a client that just upgrade to an MPLS circuit, but they have several location still on standard internet pipes. I have a backup circuit at the main location that I would like to PBR all there VPN too.

Re: Policy Based Routing for IPSec VPN

Dennis Mink — Wed, 29 Aug 2018 07:00:45 GMT

Can you add a diagram of what you are trying to achieve?

also, the MPLS circuit and 'internet pipes' as you call them, do the terminate on the same device?

I would think that routing. could decide to either go accross mpls or internet VPN.

Re: Policy Based Routing for IPSec VPN

tyler.perkey — Wed, 29 Aug 2018 13:36:17 GMT

Correct, the MPLS circuit and the "internet pipe" terminate on g0/0 and g0/2, respectively, on the ASA.

What I'm trying to achieve is 4 VPNs to remote site terminating on the internet circuit until we get those site on the MPLS cloud.

Re: Policy Based Routing for IPSec VPN

Mohammed al Baqari — Wed, 29 Aug 2018 15:33:56 GMT

What version of ASA are you running?

If you are using VTI VPNs on ASA (assuming you have a supported version),
then you can use dynamic routing to send the traffic to the VPN sites over
VPN tunnels.

If you are using crypto-maps and want to use PBRs on inside interface, ASA
support PBR starting from 9.4(1)