topic CISCO ASA 5510 source basing routing in Network Security

CISCO ASA 5510 source basing routing

Dmitriy Popov — Tue, 12 Mar 2019 00:40:27 GMT

Hi, all!

several organizations wants to place their equipment and servers in my datacenter. They want to use the same resource - 10.3.1.5. I want to connect their servers and VPN-gates via my CISCO ASA 5510. When the organization was the only on ASA was static route "10.3.1.5 via 10.200.1.2". But now this decision doesnt work. Organization1 need to go to 10.3.1.5 via VPN-gate 10.200.1.2. Organization2 need to go to 10.3.1.5 via 10.200.2.2. I cannot connect teir servers and VPN-gates directly. I should do it via ASA 5510.

I need some thing like IOS PBR (more precisely - routing based on source address). Could you advice me how I can configure scheme in attachement on my ASA? May be it will be a kind of NAT?

Note: Also I need to give access to VPN-gates from other networks (NET 1 - NET n)

CISCO ASA 5510 source basing routing

julomban — Tue, 25 Dec 2012 13:06:49 GMT

Hello Dmitriy,

I am afraid that is not possible what you are trying to accomplish with your ASA. The ASA only routes traffic based on destination IP (10.3.1.5) not by source (Organization1 and Organization2).

This is only possible on Cisco Routers.

Regards,

Juan Lombana

Please rate helpful posts.

CISCO ASA 5510 source basing routing

Andrew Phirsov — Tue, 25 Dec 2012 18:17:57 GMT

If possible, you can translate 10.3.1.5 on each VPN-gate to something unique for corresponding organization when going to ASA (using some kind of static nat). For example, on VPN gate1 you can translate 10.3.1.5 to 10.31.1.5 and to VPN gate2 - to 10.32.1.5. On ASA u'll just add two static routes each pointing to corresponding VPN-gate.

route to 10.31.1.5 via 10.200.1.2

route to 10.32.1.5 via 10.200.2.2