topic PBR with tracking error in Network Security

PBR with tracking error

Lost & Found — Tue, 12 Mar 2019 06:50:41 GMT

I already upgraded my ASA version to 9.4 and now it working with PBR.

But I'm having issues on setting up the sla monitor.

Test# sh track

Track 1

Response Time Reporter 1 reachability

Reachability is Up

276 changes, last change 00:03:02

Latest operation return code: OK

Latest RTT (millisecs) 1

Track 2

Response Time Reporter 2 reachability

Reachability is Down

1 change, last change 05:49:34

Latest operation return code: Timeout

sla monitor 1

type echo protocol ipIcmpEcho 122.X.X.X interface outside

frequency 10

sla monitor schedule 1 life forever start-time now

sla monitor 2

type echo protocol ipIcmpEcho 121.X.X.X interface outside2

frequency 10

From FW: ping test on both WAN

T# ping 122.X.X.X

!!!!!

T# ping 121.X.X.X

!!!!!

all end point was able to ping.

thanks

I suspect what is happening

Jon Marshall — Fri, 06 Nov 2015 16:55:57 GMT

I suspect what is happening is the IP SLA is using the default route to ping the IPs and so the traffic is sourced from outside2 but it goes out and comes back in via the outside interface.

You can use PBR for traffic generated by the device itself with IOS but it doesn't seem to be supported on the ASA or at least I can't find it.

So have you tied your PBR confiiguration to the IP SLA ?

If so try adding a host specific route to the ASA for the IP you are pinging on the outside2 interface ie.

route (outside2) 121.x.x.x 255.255.255.255 <next hop IP>

this should force the ping to go out of the right interface.

Unless of course the IPs you are pinging are the actual next hop IPs in which case not sure what is happening.

Jon

Hi Jon,

Lost & Found — Sat, 07 Nov 2015 12:59:43 GMT

Hi Jon,

Thanks. Youre right. Because upon check traffic is routing on 122. Anyway ill the new conf. Ill just give you the update.

Hi Jon,

Lost & Found — Fri, 13 Nov 2015 12:42:37 GMT

Hi Jon,

I forgot to edit the post. now It's working.

Thank you

Sorry but can't see photo.

Jon Marshall — Fri, 13 Nov 2015 12:42:38 GMT

Sorry but can't see photo.

Can you post a "sh route" from your ASA ?

Jon