topic Re: Policy Based Routing to ASA Inside Interface in Network Security

Policy Based Routing to ASA Inside Interface

rlesyshyn — Mon, 11 Mar 2019 20:01:18 GMT

Hi,

Is it possible to establish PBR rules that set the ip next-hop to point directly to the inside interface of the ASA5550?

Or, do I need to direct this PBR traffic first to a directly connected router interface and then default route to the ASA?

At a high level, here's what we have:

ISP 1 - with /21 IP Prefix
No BGP Routing
3845 Edge Router - Default Route to ISP 1
PIX535 Firewalls (HA) - Default Route to Edge Router
LAN Core/Distribution - Default Route to PIX535 Inside Interface
All applications/services use this egress path for PAT/NAT/DMZ/VPN/Etc.

Here's what we are adding:

ISP 2 - with /24 IP Prefix
No BGP Routing
3925E Edge Router - Default Route to ISP 2
ASA5550 Firewalls (HA) - Default Route to Edge Router
Same connectivity to LAN Core/Distribution

Goals:

Maintain ISP 1 for now
Migrate only end user Internet traffic to ISP 2
No disruptions to applications/services using current DefGW to PIX535

Question:

So, my question again is how to best use PBR to selectively direct traffic to the ASA inside interface?

Also, please feel free to suggest other methods that might be more appropriate.

Thanks!

Rob

Re: Policy Based Routing to ASA Inside Interface

Federico Coto Fajardo — Sat, 05 Mar 2011 18:55:04 GMT

Rob,

Just to be clear you're asking on how to configure PBR on the routers correct?

The reason I ask is because there's no PBR functionality on ASAs.

Federico.

Re: Policy Based Routing to ASA Inside Interface

rlesyshyn — Sat, 05 Mar 2011 19:23:15 GMT

Hi Federico,

Thanks for the reply!

I know how to use PBR and I do realize that PBR is not supported ON the ASA.

My question is can I use PBR to set an ip next-hop that points to the ASA inside interface?

In my scenario above, I do not want to make a wholesale default gateway change just yet to route all traffic away from our legacy PIX535.

I just want to selectively move traffic on a subnet by subnet to egress the new ASA.

Thanks!

Rob

Re: Policy Based Routing to ASA Inside Interface

Federico Coto Fajardo — Sat, 05 Mar 2011 19:29:19 GMT

If you have a router behind the ASA, you can configure PBR on that router to send a subset of traffic to the ASA's inside interface IP.

When configuring PBR, you can set the next-hop to be the inside IP of the ASA (the IP, not the actual interface of the ASA) but this should be no problem.

In this case it does not matter if the next-hop is an ASA, a router or any other device, you just set the next-hop to the IP address.

Federico.

Re: Policy Based Routing to ASA Inside Interface

rlesyshyn — Sat, 05 Mar 2011 19:42:10 GMT

Thanks Federico,

I thought that was in fact the case - that it is possible to policy route directly to the ASA interface ip address, but wanted to confirm.

Thanks again for your responses!

Best regards.

Rob