Routing outside two different interfaces....

haidar_alm — Mon, 11 Mar 2019 23:22:00 GMT

Hello,

I'm working on configuring a 5520 ASA device.

The requirement is that I configure two outside interfaces for two seperate public internet access. Each interface will be using a different ISP.

I've made the following configuration, and i'm not sure if this will work or not and wanted to see your opinoin:

One outside interface is named (outside), and the other one is named (SWGFL_OUTSIDE)

Please note that I've cut some of the config out...

access-list DMZ_PUBLIC_ACCESS_IN extended deny ip object-group Public-LAN object-group SDHC-LAN

access-list DMZ_PUBLIC_ACCESS_IN extended permit ip any any

access-list inside_access_in extended deny ip any any

access-list OUTSIDE_PUBLIC_ACCESS_IN extended permit icmp any any traceroute

access-list OUTSIDE_PUBLIC_ACCESS_IN extended permit udp any any eq isakmp

access-list OUTSIDE_PUBLIC_ACCESS_IN extended permit icmp any Outside 255.255.255.0

access-list DMZ-SWGFL_ACCESS_IN extended deny ip object-group SWGFL-LAN object-group SDHC-LAN

global (outside) 1 interface

global (SWGFL_OUTSIDE) 2 interface

nat (DMZ) 1 192.x.x.0 255.255.255.0.

nat (SWGFL_OUTSIDE) 2 192.168.x.0 255.255.255.128

access-group OUTSIDE_PUBLIC_ACCESS_IN in interface outside

access-group inside_access_in in interface inside

access-group DMZ_PUBLIC_ACCESS_IN in interface DMZ

access-group DMZ-SWGFL_ACCESS_IN in interface SWGFL_DMZ

route outside 0.0.0.0 0.0.0.0 192.168.x.1 1
route SWGFL_OUTSIDE 0.0.0.0 0.0.0.0 192.168.x.1 1

Would this work?

As you can see

Routing outside two different interfaces....

varrao — Fri, 22 Jun 2012 13:38:05 GMT

Hi KR,

ASA cannot have multiple default routes, it can have only one single default route. So the setup that you are trying to do would not work. Since ASA cannot do Policy based routing, if you want to do this kind of setup then you would need to do it on a router, but on ASA its not possible.

Hope that helps.

Thanks,
Varun Rao
Security Team,
Cisco TAC

Re: Routing outside two different interfaces....

John Peterson — Fri, 22 Jun 2012 15:36:46 GMT

Are any of the ISP going to only connect to a specific ip on the Internet or a list of ips ?

Sent from Cisco Technical Support iPhone App

topic Re: Routing outside two different interfaces.... in Network Security

Routing outside two different interfaces....

Routing outside two different interfaces....

Re: Routing outside two different interfaces....