We have two areas of public IP addresses. Both are configured in the ASA5510 (7.2.4, failover A/S, functions: VPN-Server, VPN L2L, SSL-VPN, Firewall, NAT)):
interface Ethernet0/0.100
description ### Path A ###
vlan 100
nameif outside-1
security-level 0
ip address 100.100.100.1 255.255.255.248 standby 100.100.100.2
!
interface Ethernet0/0.200
description ### Path B ###
vlan 200
nameif outside-2
security-level 10
ip address 200.200.200.1 255.255.255.248 standby 200.200.200.2
In DMZ we have two Server with NAT-requirement:
static (dmz,outside-1) 192.168.1.1 100.100.100.3 netmask 255.255.255.255 !--- NAT for Host-A
static (dmz,outside-2) 192.168.1.2 200.200.200.3 netmask 255.255.255.255 !--- NAT for Host-B
Default Route:
route outside-1 0.0.0.0 0.0.0.0 100.100.100.6
ASA communicates with the ISP-Router which is configured with both IP addresses - 100.100.100.6/29 and 200.200.200.6/29, through the Switch:
interface FastEthernet0/2
description ### Link to ISP-Router.100 ###
switchport access vlan 100
!
interface FastEthernet0/2
description ### Link to ISP-Router.200 ###
switchport access vlan 200
!
interface FastEthernet0/3
description ### Trunk to ASA ###
switchport trunk encapsulation dot1q
switchport mode trunk
How I can make Host B choose Path B without defining explicit target in the Routing. So much I know, ASA does not support the ASA PBR.
Does somebody have (or other) idea?
