topic many thanks Eng.Philip for in Network Security

ASA DUAL ISP

asheemy — Wed, 13 Mar 2019 01:09:56 GMT

have ASA deployment with dual ISP I need to use one ISP for WSA Proxy and VPN any connect only and the second one for DMZ Servers and if one ISP GOES DOWN the second one will take place.
Please share a good design to ache achieve this deployment as best practice.

You need to use PBR to do

Philip D'Ath — Sat, 11 Jun 2016 22:52:25 GMT

You need to use PBR to do this, which needs quite new software. Note that this only works for outbound traffic selection. It is unlikely both ISPs will allow you to use the other ISPs IP address space on their circuit.

What this means is you could create outbound redundancy, but not inbound. So if the link to the ISP that has given you address space for the DMZ goes down, all services in the DMZ that the Internet accesses will also go down.

What model ASA are you using, and what software version are you using?

many thanks Eng.Philip for

asheemy — Sat, 11 Jun 2016 23:36:39 GMT

many thanks Eng.Philip for your response , I have ASA 5585-x running version 9.4 which has PBR feature.

As i know the DMZ servers can have two NAT one per ISP so if the link on ISP1 goes down the servers can still have access to internet.

i think i can do the deployment with PBR feature is it right ?

If you don't do NAT, you can

Philip D'Ath — Sun, 12 Jun 2016 04:32:43 GMT

If you don't do NAT, you can use PBR to make the routing work.

You can probably make it work with PBR and NAT. I have not done that combination before. It sounds complicated.