topic Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING in Network Security

New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

vishnuvichu36601 — Fri, 21 Feb 2020 15:42:58 GMT

WE CONNECTED NEW ISP INTERFACE TO OUR CISCO ASA.ALREADY WE HAVE 2 ISP IN ASA.WE CONFIGURE THE INTERFACE FOR NEW ISP AND WRITE NEW NAT POLICY FOR ONE VLAN NETWORK TO CHECK WHETHER INTERNET IS WORKING OR NOT,INTERNET IS NOT WORKING.

OUR NAT POLICY IS LIKE

SOURCE INTERFACE IS NEW ISP INTERFACE

SOURCE ADDRESS IS 172.18.*.*/24

DESTINATION INTERFACE IS ANY

DESTINATION ADDRESS IN ANY

DYNAMIC PAT

SOURCE ADDRESS TRANSLATION IS OUTSIDE ISP INTERFACE

PLEASE HELP US TO SOLVE THIS ISSUE.

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

Marius Gunnerud — Sun, 06 May 2018 07:31:51 GMT

I am guessing that you did not take down the link to the existing ISP when you test? And I am also assuming that you have configured a default route pointing out the new ISP interface.

The issue is that the ASA does not support two active default routes at the same time. You would need to remove the current ISP link (and possibly the default route) to test this.

An option, if the second default route doesn't take over when the existing ISP interface is down is to set up SLA tracking.

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

vishnuvichu36601 — Sun, 06 May 2018 07:58:13 GMT

Currently two active default routes for current isp and new isp.We didnt remove the current ISP link.Is there any other way for testing the new isp Link with the help of route Map??How to do IP SLA Tracking??

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

Marius Gunnerud — Sun, 06 May 2018 11:30:41 GMT

The route map is used for policy based routing (PBR). You could use this also. See the folloing link for a guide on PBR.

access-list testACL permit ip 10.10.10.0 255.255.255.0 any

route-map access-test permit 10

match ip address testACL

set next-hop <IP of ISP2>

interface gig0/1 <-- ingress interface of source traffic.

nameif inside

security-level 100

ip add 172.16.1.1 255.255.255.0

policy-route route-map access-test

SLA tracking is quite easy to set up.

sla monitor 1

type echo protocol IpIcmpEcho 8.8.8.8 interface outside

sla monitor schedule 1 start-time now life forever

track 10 rtr 1 reachability

route outside 0 0 track 10

route outside2 0 0 254

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

vishnuvichu36601 — Sun, 06 May 2018 11:38:30 GMT

My doubts

10.10.10.0 255.255.255.0 ip address ==>> test vlan network ??

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

Marius Gunnerud — Sun, 06 May 2018 11:40:34 GMT

10.10.10.0/24 is just an example network I used. Yes this is the network you are testing from. You can limit this ACL to a single IP also if you choose.

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

vishnuvichu36601 — Sun, 06 May 2018 11:42:10 GMT

sir,During these configuration any internet will down for other network?

Can you tell me the SLA tracking?

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

Marius Gunnerud — Sun, 06 May 2018 11:44:30 GMT

no internet will not go down when configuring it. Though when removing SLA tracking from the default route. you will need to remove the route completely and add it back without the tracking. In this case there might be a small "blip" but that should only last less than a second if you apply the change using a script.

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

vishnuvichu36601 — Sun, 06 May 2018 11:46:36 GMT

without configure SLA tracking.My test scenario will work or not?

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

Marius Gunnerud — Sun, 06 May 2018 11:49:32 GMT

The issue will be that with and without SLA your network will go down if ISP 2 does not work or is not ready.

if you can not have any down time it is probably better to use policy based routing

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

vishnuvichu36601 — Sun, 06 May 2018 11:52:25 GMT

we already have load-balancing. We need to check only the newly connected
ISP is working or not. So the only pbr is required for our scenario. Is it
correct?

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

Marius Gunnerud — Sun, 06 May 2018 11:54:04 GMT

Correct

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

vishnuvichu36601 — Sun, 06 May 2018 11:56:25 GMT

Sir, We will configure and tell whether it's worked or not?

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

vishnuvichu36601 — Sun, 06 May 2018 12:03:44 GMT

hello,Any static route we need to configure for ISP Interface?Can you tell me the static Route is rquired or not?

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

Marius Gunnerud — Sun, 06 May 2018 12:08:27 GMT

Static route is not necessary when using PBR

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

vishnuvichu36601 — Sun, 06 May 2018 12:10:25 GMT

in this configuration no need to add a static route for new isp and only
configure the interface for new isp and pbr, route map

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

vishnuvichu36601 — Mon, 07 May 2018 02:36:25 GMT

route-map acl-name permit 1
match ip address "test-network"
match interface "new-isp-outside"
match metric 2
set ip next-hop "new isp"

is this configuration is ok??

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

vishnuvichu36601 — Mon, 07 May 2018 04:03:25 GMT

interface gig0/1 <-- ingress interface of source traffic.

nameif inside

security-level 100

ip add 172.16.1.1 255.255.255.0 ====>ip address of ???

policy-route route-map access-test

while we configure this inside interface policy-route the other network
will effect this internet?
Where we configure the policy-route route map in asdm ?

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

Marius Gunnerud — Mon, 07 May 2018 06:05:09 GMT

This is not correct. You are matching on two diferent interfaces at the same time which can never happen. I proveded a sample configuration for you earlier. here it is again.

access-list testACL permit ip 10.10.10.0 255.255.255.0 any

route-map access-test permit 10

match ip address testACL

set next-hop <IP of ISP2>

interface gig0/1 <-- This interface is the on closest to your inside network

nameif inside

security-level 100

ip add 172.16.1.1 255.255.255.0

policy-route route-map access-test

Re: New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

vishnuvichu36601 — Mon, 07 May 2018 06:08:25 GMT

This configuration we can give only through cli not through asdm?