topic ASA with two default gateways in Network Security

ASA with two default gateways

zac192000 — Mon, 11 Mar 2019 22:35:17 GMT

I am actually going to setup my ASA 5505 with two different outside ISPs such that half of inside lan networks will be natted into 1 ISP and other half of the inside lan networks will be natted into other ISP ,so this means

1.1.1.1/24 is our one ISP

2.2.2.2/24 is our second ISP

192.168.1.0/24 is our inside lan

Now i want 192.168.1.2-192.168.1.125 to be natted to one ISP

and 192.168.1.126-192.168.1.254 to be natted into second ISP

1hile default gateway is same i.e 192.168.1.1

so,it will be something like this

global (outside1) 1 interface

global (outside2) 2 interface

nat (inside) 1 192.168.1.1 255.255.255.128

nat (inside) 2 192.168.1.128 255.255.255.128

and then i have

route ISP1 0.0.0.0 0.0.0.0 1

route ISP2 0.0.0.0 0.0.0.0 2

Will this work that way?

ASA with two default gateways

rizwanr74 — Mon, 27 Feb 2012 15:42:54 GMT

I see no problem on your setup, as long as you maintain same mask on the inside network.

nat (inside) 1 192.168.1.0 255.255.255.128

nat (inside) 2 192.168.1.128 255.255.255.128

ASA with two default gateways

Patrick0711 — Mon, 27 Feb 2012 16:51:42 GMT

route ISP1 0.0.0.0 0.0.0.0 1

route ISP2 0.0.0.0 0.0.0.0 2

You need a gateway IP address specified for each route statement. Additionally, the bold numbers are administrative distance metrics and don't correlate to the NAT/Global configuration.

The route with the metric of 1 will always be used. You would need to specify different destinations in the route statements for traffic to be routed across the second ISP link.

Multiple default routes can only be used for backup ISP configurations where you would configure a SLA monitor, a track that references the monitor, and a route that references the track.

Re: ASA with two default gateways

zac192000 — Mon, 27 Feb 2012 21:48:45 GMT

So can we do active/active load balancing or not for our both ISPs?

Sent from Cisco Technical Support iPad App

Re: ASA with two default gateways

Patrick0711 — Tue, 28 Feb 2012 14:04:49 GMT

Not without a separate load balancer device. Your only option for multiple gateways is a primary/backup config usin sla monitor and track configurations.

ASA with two default gateways

John Peterson — Tue, 20 Mar 2012 20:43:31 GMT

Hi, is this still not possible with route-maps to point traffic to a different ISP based on source.

I guess the ASA is not able to have two default routes, but if you have the second ISP as a high AD, could you then nat certain sourse addresses to the second ISP?