topic Re: Hosting a web service with Dual ISP connections on ASA in Network Security

Hosting a web service with Dual ISP connections on ASA

magurwara — Fri, 21 Feb 2020 16:04:26 GMT

I am getting deny reverse path check errors when trying to host a TCP service on the firewall that has two ISP links.

Trying to host the service on ISP-2 IP range while the default route on the firewall is through ISP-1.

Using route-map to route the traffic out through ISP-2 works fine which I thought would be enough for hosting the service as well since the incoming requests should be coming in via ISP-2's link. However, the incoming request to the hosted service fails due to the reverse path check failure.

Is there a workaround? Further configurations? Or is there no way to make this work without disabling reverse path check?

Thanks

Re: Hosting a web service with Dual ISP connections on ASA

Mohammed al Baqari — Wed, 08 Aug 2018 08:27:33 GMT

The command 'no ip verify reverse-path interface IF-NAME' disables uRPF

Re: Hosting a web service with Dual ISP connections on ASA

magurwara — Wed, 08 Aug 2018 11:39:02 GMT

Thanks Mohammed but disabling reverse path check is what I don't want to do.

However, I am wondering whether it is serving a purpose in this scenario.

Re: Hosting a web service with Dual ISP connections on ASA

magurwara — Thu, 16 Aug 2018 15:42:38 GMT

Hi All,

I found a possible solution to this problem without disabling uRPF check. However, it cannot be used in our case (see below). Still sharing so that this may be useful for anyone having a similar problem.

The solution could be to configure a Traffic Zone, say, 'Internet'. Put both ISP interfaces into this zone. It will then allow traffic to enter or leave from any interface within the zone.

From ASDM GUI:

"You can assign multiple interfaces to a traffic zone, which lets traffic from an existing flow exit or enter the ASA on any interface within the zone."

However, within the documentation, it warns that .....

"Do not configure other services (such as VPN or Botnet Traffic Filter) for interfaces in a traffic zone; they may not function or scale as expected."

This in my case will leave this solution useless as we do host VPNs on the interfaces I was planning to put in this zone. I guess with further configuration, a new interface could be configured in this zone and all non-vpn services could be made part of this as all Access Rules, NAT, Service Rules (other than QoS traffic policing), and Routing are supported with zones.

Any thoughts from any one?