topic Using multiple outside interface on ASA 5520 in Network Security

Using multiple outside interface on ASA 5520

sk2317 — Mon, 11 Mar 2019 18:29:23 GMT

Hi Moderator,

I have the following query with regards to Firewall.

1) Will global nat forward the traffic to respective gateways of ISP i.e Global ID 13, should always forward to 100.X.X.X and 14 should 200.X.X.X through default route.

2) In the event of primary internet goes down, what are the challenges ? assuming i have ISP independent public IP pool.

Thanks in advance.

S Kumar

*********Config START************************************

interface Gi0/0
description Primary Internet
nameif outside
security-level 0
ip address 100.X.X.X 255.255.255.0
!
interface Gi0/1
description Secondary Internet
nameif outside-2
security-level 0
ip address 200.X.X.X 255.255.255.0

!
interface Gi0/2
description Corporate network
nameif INSIDE
security-level 100
ip address 10.10.10.1 255.255.255.0

route inside 10.10.20.0 255.255.255.0 10.10.10.10 1
route inside 10.10.30.0 255.255.255.0 10.10.10.10 1

!
global (outside) 13 100.X.X.X
global (outside) 14 200.X.X.X

nat (inside) 13 10.10.20.0 255.255.255.0
nat (inside) 14 10.10.30.0 255.255.255.0

route outside 0.0.0.0 0.0.0.0 100.X.X.X
route outside 0.0.0.0 0.0.0.0 200.X.X.X
************Config-END*********************************

Re: Using multiple outside interface on ASA 5520

Kureli Sankar — Mon, 23 Aug 2010 13:54:37 GMT

Kumar,

I believe you meant

route outside-2 0.0.0.0 0.0.0.0 200.X.X.X and not route outside 0.0.0.0 0.0.0.0 200.X.X.X

In either case the ASA can only load balance up to 3 default GW out the SAME interface not out diff. interfaces.

You need to do PBR (Policy Based Routing) using a Layer 3 device on the outside.

Pls. read this thread where I have answered this in the past: https://supportforums.cisco.com/message/894920

You can also do SLA route tracking: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

-KS

Re: Using multiple outside interface on ASA 5520

sk2317 — Mon, 23 Aug 2010 14:15:16 GMT

Hi Kusankar,

Thanks for your reply and correction as follow.

route outside-2 0.0.0.0 0.0.0.0 200.X.X.X

I would like to load balance outbound traffic based on Global nat.

I.e Few vlans would use global nat 13 to forward traffic to OUTSIDE (interface)

and remaining vlan would use global nat 14 to forward traffic to OUTSIDE-2 (interface)

In the event of outage at primary ISP, both Global nat 13 and 14 should use the OUTSIDE-2 (interface)

Would this workout practically ?

Thanks

Kumar

Re: Using multiple outside interface on ASA 5520

Kureli Sankar — Mon, 23 Aug 2010 14:21:47 GMT

Yes, only in the scenario that I mentioned on the thread link that I enclosed. Pls. read that. You cannot add two default routes on the ASA pointing to two diff. interface. It does not work.

Outside

inside---ASA---Rourter/

| \

DMZ \

Outside-2

-KS

Re: Using multiple outside interface on ASA 5520

sk2317 — Mon, 23 Aug 2010 15:14:18 GMT

Thanks kusankar,

Since i have two different public pool, how will it accomadate two IP network between ASA <-----to------> Router ?

As, asa does not seems to support sub-interface, or secondary command.

Thanks,

Kumar

Re: Using multiple outside interface on ASA 5520

Kureli Sankar — Mon, 23 Aug 2010 15:24:17 GMT

Kumar,

You can use any IP address on the ASA to translate. An interface doesn't have to be configued on the ASA to be able to use the IP block for translation. You can just use a private ip subnet between the ASA and the Router.

Like I discussed on that previous thread, you can use ISP1 block one for all dynamic nat translations and use ISP2 block IP for all static nat translations - all on the ASA. Then the router will look at the packet if it has source address provided by ISP1 (after translation from the ASA) then it will send the packet via ISP1 link and if the packets have the source address of ISP2 (after translation from the ASA) provided address then it will send the packets via ISP2 link. This can be configued using PBR - route maps and setting the next hop on the router.

-KS

Re: Using multiple outside interface on ASA 5520

sk2317 — Mon, 23 Aug 2010 17:12:09 GMT

Hi Kusankar,

As said, having configured private IP between ASA and Router, Will i be able to terminate Site to Site VPN or Remote VPN on ASA ?

Thanks,

Kumar.

Re: Using multiple outside interface on ASA 5520

Kureli Sankar — Tue, 24 Aug 2010 12:13:31 GMT

So long as the router can translate the ASA's outside interface statically (1-1) to a routable address, I don't see why not.

-KS

Re: Using multiple outside interface on ASA 5520

Kan2 — Thu, 05 Oct 2017 11:44:02 GMT

Hi ,

I am plaiing to do the Primary and Backup setup on ASA , how the when primary fail over to backup

what will happen to all NAT config

Manual NAT Policies (Section 1)
1 (inside) to (outside) source static FR-abc-company-Network FR-abc-company-Network destination static BE-abc-company-Network BE-abc-company-Network no-proxy-arp route-lookup
2 (inside) to (outside) source static FR-abc-company-Network FR-abc-company-Network destination static US-abc-company-Network US-abc-company-Network no-proxy-arp route-lookup
4 (inside) to (outside) source static FR-abc-company-Network FR-abc-company-Network destination static SG-abc-company-Network SG-abc-company-Network no-proxy-arp route-lookup

Auto NAT Policies (Section 2)
1 (inside) to (outside) source static obj-10.22.0.99 178.132.22.10
2 (Guest) to (outside) source dynamic Guest-Network interface
3 (inside) to (outside) source dynamic obj_any interface

Do I need to created another setup of Manual and Auto NAT rules for "backup" outside interface

Manual NAT Policies (Section 1)
1 (inside) to (backup) source static FR-abc-company-Network FR-abc-company-Network destination static BE-abc-company-Network BE-abc-company-Network no-proxy-arp route-lookup
2 (inside) to (backup) source static FR-abc-company-Network FR-abc-company-Network destination static US-abc-company-Network US-abc-company-Network no-proxy-arp route-lookup
4 (inside) to (backup) source static FR-abc-company-Network FR-abc-company-Network destination static SG-abc-company-Network SG-abc-company-Network no-proxy-arp route-lookup

Auto NAT Policies (Section 2)
1 (inside) to (backup) source static obj-10.22.0.99 192.135.20.10
2 (Guest) to (backup) source dynamic Guest-Network interface
3 (inside) to (backup) source dynamic obj_any interface

Re: Using multiple outside interface on ASA 5520

Elopower123 — Thu, 06 Dec 2018 08:31:47 GMT

Hi, I'm Joseph. I'm using an ASA5540 firewall router to Connect my LAN to my ISP, the LAN is on the inside interface of the router while the ISP is on the outside interface. From my LAN I can ping the inside interface but I can't ping the outside interface. Apparently two distant interfaces on a CISCO asa router cannot by default communicate with each other, so I'm looking for a way to link the two interfaces. Any help will be greatly appreciated. Thanks.