topic If I change to configuration: in Network Security

Differentiate traffic between two ISP

dogalov.m — Tue, 12 Mar 2019 09:10:44 GMT

I have Cisco ASA5525-MB, Software Version 9.2(2)4, one inside network and two ISP.
I need direct traffic to specific server in the Internet (3.3.3.1) through ISP2 only, and to other destinations through ISP1. How to configure routing and NAT?

Portion of my ASA configuraion:

interface GigabitEthernet0/0
nameif ISP1
ip address 1.1.1.1 255.255.255.252

interface GigabitEthernet0/1
nameif ISP2
ip address 2.2.2.1 255.255.255.252

interface GigabitEthernet0/2
nameif Inside
ip address 172.16.0.2 255.255.255.252

object network Inside
subnet 10.0.0.0 255.255.255.0
nat (Inside,ISP1) dynamic interface

route ISP1 0.0.0.0 0.0.0.0 1.1.1.2 1

Assuming the ISP2 gateway is

Marvin Rhoads — Wed, 05 Apr 2017 08:07:44 GMT

Assuming the ISP2 gateway is 2.2.2.2, then you should be able to use the following:

route ISP2 3.3.3.1 255.255.255.255 2.2.2.2
nat (Inside,ISP2) dynamic interface

If I change to configuration:

dogalov.m — Wed, 05 Apr 2017 11:05:35 GMT

If I change to configuration:

object network Inside
subnet 10.0.0.0 255.255.255.0
nat (Inside,ISP2) dynamic interface

route ISP2 3.3.3.1 255.255.255.255 2.2.2.2

The result is I'm going to this server through ISP2 successfully but I haven't connection to other rest of Internet.

If I change to configuration:

object network Host
host 10.1.1.1
nat (Inside,ISP2) dynamic interface

route ISP2 3.3.3.1 255.255.255.255 2.2.2.2

The result is I'm going to this server through ISP2 successfully and I'm going to other rest of Internet successfully through ISP1. But I need apply this to hole inside subnet.

Sorry - your two NAT

Marvin Rhoads — Wed, 05 Apr 2017 11:17:56 GMT

Sorry - your two NAT statements need to both be after-auto type.

Try removing the existing interface NAT and use this instead:

nat (inside,ISP1) after-auto source dynamic any interface
nat (inside,ISP2) after-auto source dynamic any interface

You should also "clear xlate" after making NAT changes to clear any existing translations.

Thank you Marvin

dogalov.m — Wed, 05 Apr 2017 11:39:07 GMT

Thank you Marvin