topic Re: ASA_PBR in Network Security

ASA_PBR

tamas.horvath — Wed, 17 Apr 2019 15:39:22 GMT

Hi All,

I would like to set policy-based routing on ASA 55XX. Http traffic coming from a vlan should be routed to an interface of
a not directly connected content filter which is in a different subnet.
Could you please share a sample configuration of a similar scenario with me?

Thank you in advance,
Tamas

Re: ASA_PBR

Karsten Iwen — Wed, 17 Apr 2019 21:57:25 GMT

You can't tell PBR to send the traffic to a remote device. Does the content-engine support WCCP? That could be an option depending on your setup.

Re: ASA_PBR

joseph.h.nguyen — Thu, 18 Apr 2019 00:14:24 GMT

I don't have a sample configuration but you can refer to Cisco guide, https://www.cisco.com/c/en/us/td/docs/security/asa/asa94/config-guides/cli/general/asa-94-general-config/route-policy-based.pdf

I agree with Karsten that a more simple solution to your design is to use WCCP if available on the content filter. Otherwise, you would have to implement PBR on each Layer 3 hop to get to your content filter.

Re: ASA_PBR

tamas.horvath — Thu, 18 Apr 2019 07:20:12 GMT

Thanks.

And how would this issue be solved if the ASA and the content filter are on different sites wich are connected by a site2site vpn tunnel?

Re: ASA_PBR

tamas.horvath — Thu, 18 Apr 2019 07:21:54 GMT

Thanks.
And how would this issue be solved if the ASA and the content filter are on different sites wich are connected by a site2site vpn tunnel?

Re: ASA_PBR

Karsten Iwen — Thu, 18 Apr 2019 08:07:24 GMT

That won't work due to WCCP-limitations in the ASA. You could do WCCP on the Upstream L3-Switch where your ASA is connected to.