ASA 5506-X 9.6 Problems routing specific destinations over second WAN

Robbert Tol — Fri, 21 Feb 2020 15:23:46 GMT

Hi there,

I am an newby in Cisco ASA and before the customer had two Zyxel Firewall's which had any problems with the Site to site VPN's and the second WAN on the HQ Location.

The problem is as follow:

on the HQ, the ASA has two internal VLAN's (Production and Guest) and two WAN Interfaces.

The First WAN Interface (name WAN) is for normal internet traffic and has also an Site to Site with the branche office. On the Second WAN Port (WAN_PON) is an DealerNetwork connected (kind of an intranet secured) on which serveral servers deliver apps and webservices.

What a want to accomplish is that all trafic which is sent to destinations 10.0.0.0/8 and 192.200.0.0/16 is sent over the WAN_PON Interface. all other internet trafic must be sent to the normal WAN.

On the Branch Office, which is connected by an site-to-site VPN with the HQ, i also want to be able to access those networks at the WAN_PON Interface at the HQ.

I'm so sorry that i can't figure it out, so please help if you can.

Below you find the config's of both ASA's. Both are running v9.6(4) software.

Kind Regards,

Robbert

HQ Config:

hostname ASA5506X-VDL

domain-name company.local

enable password $sha512$5000$IvpLaK7wslmhXCYc77Z2Dg==$IMVR8WShj36y5fUcEe0Uqg== pbkdf2

names

no mac-address auto

ip local pool VPN_DHCP_Pool 192.168.10.1-192.168.10.200 mask 255.255.255.0

interface GigabitEthernet1/1

description Inside LAN Interface ASA5506-X

no nameif

no security-level

no ip address

interface GigabitEthernet1/1.1

description company VLAN10 Interface LAN Netwerk

vlan 10

nameif VLAN10

security-level 100

ip address 192.168.100.1 255.255.255.0

policy-route route-map PON_MAP

interface GigabitEthernet1/1.2

description company VLAN20 Interface Guest Netwerk

vlan 20

nameif VLAN20

security-level 25

ip address 192.168.250.1 255.255.255.0

interface GigabitEthernet1/2

description WAN Interface Tele2 Fiber Internet

speed 100

duplex full

nameif WAN

security-level 0

ip address 1.1.1.94 255.255.255.248

interface GigabitEthernet1/3

description PON WAN Interface

nameif WAN_PON

security-level 0

ip address 10.49.240.10 255.255.255.0

interface GigabitEthernet1/4

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet1/5

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet1/6

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet1/7

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet1/8

shutdown

no nameif

no security-level

no ip address

interface Management1/1

management-only

no nameif

no security-level

no ip address

boot system disk0:/asa964-lfbff-k8.SPA

ftp mode passive

dns domain-lookup VLAN10

dns domain-lookup VLAN20

dns domain-lookup WAN

dns domain-lookup WAN_PON

dns server-group DefaultDNS

name-server 8.8.8.8

name-server 8.8.4.4

name-server 10.150.1.3

name-server 192.168.100.21

domain-name company.local

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network Gonzo_LAN

host 192.168.100.22

description Microsoft Exchange 2010 Server company

object network Gonzo_WAN

host 1.1.1.90

description Microsoft Exchange 2010 Server company WAN Address

object network Gonzo_LAN_SMTP

host 192.168.100.22

object network Gonzo_LAN_HTTPS

host 192.168.100.22

object network Camera_LAN

host 192.168.100.10

object network Camera_WAN

host 1.1.1.92

object network Camera_LAN_554

host 192.168.100.10

object network Camera_LAN_8000

host 192.168.100.10

object network Camera_LAN_8099

host 192.168.100.10

object network Hyper_LAN

host 192.168.100.250

object network Hyper_WAN

host 1.1.1.91

object network Hyper_LAN_HTTPS

host 192.168.100.250

object network Hyper_LAN_17990

host 192.168.100.250

object network Zoetermeer_LAN

subnet 192.168.1.0 255.255.255.0

object network Zoetermeer_WAN

host 2.2.2.98

object network VLAN10_Subnet

subnet 192.168.100.0 255.255.255.0

description VLAN10 company LAN Subnet

object network VLAN20_Subnet

subnet 192.168.250.0 255.255.255.0

description VLAN20 company Guest Subnet

object network NETWORK_OBJ_192.168.10.0_24

subnet 192.168.10.0 255.255.255.0

object network NETWORK_OBJ_192.168.100.0_24

subnet 192.168.100.0 255.255.255.0

object network PON_192_200_0_0

subnet 192.200.0.0 255.255.0.0

object network PON_10_0_0_0

subnet 10.0.0.0 255.0.0.0

object network VLAN10_PON

subnet 192.168.100.0 255.255.255.0

object-group service Gonzo_Services

service-object tcp destination eq https

service-object tcp destination eq smtp

object-group service Camera_Services

service-object tcp destination eq rtsp

service-object tcp destination eq 8000

service-object tcp destination eq 8099

object-group service Hyper_Services

service-object tcp destination eq https

service-object tcp destination eq 17990

object-group network PON_Network_Group

network-object object PON_10_0_0_0

network-object object PON_192_200_0_0

access-list outside_inside extended permit icmp any any echo

access-list outside_inside extended permit udp any any range 33434 33523

access-list outside_inside extended permit icmp any any time-exceeded

access-list outside_inside extended permit icmp any any source-quench

access-list outside_inside extended permit icmp any any echo-reply

access-list outside_inside extended permit icmp any any unreachable

access-list outside_inside extended permit object-group Gonzo_Services any object Gonzo_LAN

access-list outside_inside extended permit object-group Camera_Services any object Camera_LAN

access-list outside_inside extended permit object-group Hyper_Services any object Hyper_LAN

access-list outside_inside extended deny ip any any

access-list ICMPACL extended permit icmp any any

access-list outbound extended permit tcp host 192.168.100.22 any eq smtp

access-list outbound extended deny tcp any any eq smtp

access-list outbound extended permit ip any any

access-list PON_Inside extended permit icmp any any echo

access-list PON_Inside extended permit udp any any range 33434 33523

access-list PON_Inside extended permit icmp any any time-exceeded

access-list PON_Inside extended permit icmp any any source-quench

access-list PON_Inside extended permit icmp any any echo-reply

access-list PON_Inside extended permit icmp any any unreachable

access-list Split_Tunnel standard permit 192.168.100.0 255.255.255.0

access-list Split_Tunnel standard permit 192.168.4.0 255.255.255.0

access-list WAN_cryptomap extended permit ip 192.168.100.0 255.255.255.0 object Zoetermeer_LAN

access-list ACL_PONNET standard permit 10.0.0.0 255.0.0.0

pager lines 24

logging enable

logging asdm informational

mtu VLAN10 1500

mtu VLAN20 1500

mtu WAN 1500

mtu WAN_PON 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-791-151.bin

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

arp rate-limit 16384

nat (VLAN10,WAN) source static any any destination static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 no-proxy-arp route-lookup

nat (VLAN10,WAN) source static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 destination static Zoetermeer_LAN Zoetermeer_LAN no-proxy-arp route-lookup

object network Gonzo_LAN

nat (VLAN10,WAN) static Gonzo_WAN

object network Gonzo_LAN_SMTP

nat (VLAN10,WAN) static Gonzo_WAN service tcp smtp smtp

object network Gonzo_LAN_HTTPS

nat (VLAN10,WAN) static Gonzo_WAN service tcp https https

object network Camera_LAN_554

nat (VLAN10,WAN) static Camera_WAN service tcp rtsp rtsp

object network Camera_LAN_8000

nat (VLAN10,WAN) static Camera_WAN service tcp 8000 8000

object network Camera_LAN_8099

nat (VLAN10,WAN) static Camera_WAN service tcp 8099 8099

object network Hyper_LAN_HTTPS

nat (VLAN10,WAN) static Hyper_WAN service tcp https https

object network Hyper_LAN_17990

nat (VLAN10,WAN) static Hyper_WAN service tcp 17990 17990

object network VLAN10_Subnet

nat (VLAN10,WAN) dynamic interface

object network VLAN20_Subnet

nat (VLAN20,WAN) static Camera_WAN

object network VLAN10_PON

nat (VLAN10,WAN_PON) static interface

access-group outside_inside in interface WAN

access-group PON_Inside in interface WAN_PON

route-map PON_MAP permit 10

match ip address ACL_PONNET

set interface WAN_PON

set ip default next-hop 10.49.240.1

route WAN 0.0.0.0 0.0.0.0 1.1.1.89 1

route WAN_PON 10.0.0.0 255.0.0.0 10.49.240.1 1

route VLAN10 192.168.4.0 255.255.255.0 192.168.100.253 1

route WAN_PON 192.200.0.0 255.255.0.0 10.49.240.1 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

timeout conn-holddown 0:00:15

aaa-server Radius-Kermit protocol radius

aaa-server Radius-Kermit (VLAN10) host 192.168.100.21

key *****

radius-common-pw vdL!nd3n2018?

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

http server enable

http 192.168.100.0 255.255.255.0 VLAN10

no snmp-server location

no snmp-server contact

service sw-reset-button

******* REMOVED CRYPTO LINES FOR LENGTH ********

crypto ikev2 enable WAN client-services port 443

crypto ikev2 remote-access trustpoint vpn_company-groep_nl

crypto ikev1 enable WAN

crypto ikev1 policy 10

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 20

authentication rsa-sig

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 40

authentication pre-share

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 50

authentication rsa-sig

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 70

authentication pre-share

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 80

authentication rsa-sig

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 100

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 110

authentication rsa-sig

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 130

authentication pre-share

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 140

authentication rsa-sig

encryption des

hash sha

group 2

lifetime 86400

telnet timeout 5

no ssh stricthostkeycheck

ssh 192.168.100.0 255.255.255.0 VLAN10

ssh timeout 5

ssh cipher encryption all

ssh key-exchange group dh-group1-sha1

console timeout 0

dhcpd dns 8.8.8.8 8.8.4.4

dhcpd address 192.168.250.10-192.168.250.200 VLAN20

dhcpd enable VLAN20

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ssl trust-point vpn_company-groep_nl VLAN10

ssl trust-point vpn_company-groep_nl VLAN20

ssl trust-point vpn_company-groep_nl WAN

ssl trust-point vpn_company-groep_nl WAN_PON

webvpn

enable WAN

anyconnect image disk0:/anyconnect-macos-4.5.01044-webdeploy-k9.pkg 1

anyconnect image disk0:/anyconnect-win-4.5.01044-webdeploy-k9.pkg 2

anyconnect profiles ASA5506-X_company_client_profile disk0:/ASA5506-X_company_client_profile.xml

anyconnect enable

tunnel-group-list enable

cache

disable

error-recovery disable

group-policy "GroupPolicy_ASA5506-X company" internal

group-policy "GroupPolicy_ASA5506-X company" attributes

wins-server none

dns-server value 192.168.100.21

vpn-tunnel-protocol ikev2 ssl-client

split-tunnel-policy excludespecified

split-tunnel-network-list value Split_Tunnel

default-domain value company.local

webvpn

anyconnect profiles value ASA5506-X_company_client_profile type user

group-policy GroupPolicy_2.2.2.98 internal

group-policy GroupPolicy_2.2.2.98 attributes

vpn-tunnel-protocol ikev1 ikev2

dynamic-access-policy-record DfltAccessPolicy

username admin password $sha512$5000$mXimwUYVhPk6HBnK+ct8NQ==$sj3JFxcM4u/aw/0LN3W9FQ== pbkdf2 privilege 15

tunnel-group "ASA5506-X company" type remote-access

tunnel-group "ASA5506-X company" general-attributes

address-pool VPN_DHCP_Pool

authentication-server-group Radius-Kermit

default-group-policy "GroupPolicy_ASA5506-X company"

tunnel-group "ASA5506-X company" webvpn-attributes

group-alias "ASA5506-X company" enable

tunnel-group 2.2.2.98 type ipsec-l2l

tunnel-group 2.2.2.98 general-attributes

default-group-policy GroupPolicy_2.2.2.98

tunnel-group 2.2.2.98 ipsec-attributes

ikev1 pre-shared-key *****

ikev2 remote-authentication pre-shared-key *****

ikev2 local-authentication pre-shared-key *****

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

no tcp-inspection

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

Cryptochecksum:e6f9318f1bbd2d0e7efbbfcf31235c35

ASA Branche Office

ASA Version 9.6(4)

hostname ASA5506X-ZTM

domain-name company.local

enable password $sha512$5000$q37wopLLpi3FeO/gR9nBag==$iiYKD04GYsEvzb6hpHu6QQ== pbkdf2

names

no mac-address auto

interface GigabitEthernet1/1

description WAN Interface Address company Zoetermeer

nameif outside

security-level 0

ip address 6.6.6.98 255.255.255.252

interface GigabitEthernet1/2

description LAN Interface company Zoetermeer

nameif inside

security-level 100

ip address 192.168.1.254 255.255.255.0

interface GigabitEthernet1/3

shutdown

no nameif

security-level 100

no ip address

interface GigabitEthernet1/4

shutdown

no nameif

security-level 100

no ip address

interface GigabitEthernet1/5

shutdown

no nameif

security-level 100

no ip address

interface GigabitEthernet1/6

shutdown

no nameif

security-level 100

no ip address

interface GigabitEthernet1/7

shutdown

no nameif

security-level 100

no ip address

interface GigabitEthernet1/8

shutdown

no nameif

security-level 100

no ip address

interface Management1/1

management-only

no nameif

no security-level

no ip address

boot system disk0:/asa964-lfbff-k8.SPA

ftp mode passive

dns domain-lookup outside

dns domain-lookup inside

dns server-group DefaultDNS

name-server 8.8.8.8 inside

name-server 192.168.100.21

name-server 8.8.4.4

domain-name company.local

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network Internal_LAN

subnet 192.168.1.0 255.255.255.0

object network Waddinxveen

subnet 192.168.100.0 255.255.255.0

description Waddinxveen Subnet HQ

object network NETWORK_OBJ_192.168.1.0_24

subnet 192.168.1.0 255.255.255.0

access-list outside_inside extended permit icmp any any echo

access-list outside_inside extended permit udp any any range 33434 33523

access-list outside_inside extended permit icmp any any time-exceeded

access-list outside_inside extended permit icmp any any source-quench

access-list outside_inside extended permit icmp any any echo-reply

access-list outside_inside extended permit icmp any any unreachable

access-list outside_inside extended deny ip any any

access-list ICMPACL extended permit icmp any any

access-list outbound extended permit tcp host 192.168.100.22 any eq smtp

access-list outbound extended deny tcp any any eq smtp

access-list outbound extended permit ip any any

access-list outside_cryptomap extended permit ip 192.168.1.0 255.255.255.0 object Waddinxveen

pager lines 24

logging asdm informational

mtu outside 1500

mtu inside 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-791-151.bin

no asdm history enable

arp timeout 14400

arp permit-nonconnected

arp rate-limit 8192

nat (inside,outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static Waddinxveen Waddinxveen no-proxy-arp route-lookup

object network Internal_LAN

nat (inside,outside) dynamic interface

access-group outside_inside in interface outside

route outside 0.0.0.0 0.0.0.0 6.6.6.97 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

timeout conn-holddown 0:00:15

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

http 192.168.100.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

service sw-reset-button

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des