topic Re: routing outbound traffic to 2 interfaces on asa in Network Security

routing outbound traffic to 2 interfaces on asa

cfajardo1_2 — Mon, 11 Mar 2019 12:28:08 GMT

given;

rtr1 connected to outside

rtr2 connected to dmz1

lan connected to inside

we wanted to achieve the ff;

-mail traffic to go to the OUTSIDE

-http traffic to go to the DMZ1

how can we achieve the above on ASA

Re: routing outbound traffic to 2 interfaces on asa

Alan Huseyin Kayahan — Mon, 07 Apr 2008 17:33:43 GMT

Hi Celso,

Cisco firewalls do not support PBR (Policy Based Routing). Technically, what you want to achieve is impossible since you dont have specific destinations. But if you have the IP addresses of your destinations (which you cant for smtp or www traffic), following is the workaround.

Following config will redirect mail traffic to outside and rest of the traffic including web to dmz1.

access-list smtp_nat_outbound permit ip insideipsubnet insidenetmask any eq smtp

nat (inside) 1 access-list smtp_nat_outbound

global (outside) 1 interface

nat (inside) 2 0 0

global (dmz1) 2 interface

route outside mailserver1ip 255.255.255.255 rtr1ip

route outside mailserver2ip 255.255.255.255 rtr1ip

route outside mailserver3ip 255.255.255.255 rtr1ip

route dmz1 0.0.0.0 0.0.0.0 rtr2ip

Regards

Re: routing outbound traffic to 2 interfaces on asa

cfajardo1_2 — Wed, 09 Apr 2008 13:15:39 GMT

That make sense. Thanks a lot.

Re: routing outbound traffic to 2 interfaces on asa

Alan Huseyin Kayahan — Wed, 09 Apr 2008 13:32:33 GMT

You are welcome.