topic Re: Multiple Outside Networks ASA - 1 Outside Interface in Network Security

Multiple Outside Networks ASA - 1 Outside Interface

cceykovsky — Fri, 21 Feb 2020 11:05:35 GMT

Scenario Example:

Site A 20.0.0.0 (Primary)

Site B 30.0.0.0 (Primary)

Greetings,

From a routing point of view with 2 routers at each site and advertisements via BGP I don't see this being a problem. We'll advertise both networks at each site. However, primarily only site A will get 20.0.0.0 traffic and site B will get 30.0.0.0 traffic. No problems there with NAT and so forth.

What I don't know how to handle at the moment is if say site B fails and site A starts receiving 30.0.0.0 traffic. There will be just a single link between site A's router and firewall, with the 20.x.x.x network. Any recommendations how site A can receive 30.0.0.0 seamlessly if site B were to fail? (from an ASA/NAT Point of view)

Thank you

Re: Multiple Outside Networks ASA - 1 Outside Interface

Jon Marshall — Mon, 10 Nov 2008 17:32:43 GMT

Chris

Is it safe to assume that your ASA has a route to the 30.0.0.0 network from it's inside interface ?

If so

static (inside,outside) 30.0.0.0 30.0.0.0 netmask 255.0.0.0

as long as traffic for 30.0.0.0 is then routed to the outside interface of site A firewall it can then accept this traffic and forward it on internally.

If i have misunderstood let me know.

Jon

Re: Multiple Outside Networks ASA - 1 Outside Interface

cceykovsky — Tue, 18 Nov 2008 22:51:32 GMT

Hey Jon,

I think you hit it right on the head and I got that information elsewhere. Apolgize for responding so late, but thank you for the response.