asa reverse path check and policy routing

[DraganSkundric87318]

imagine basic asa setup with two outside interfaces, two providers, and one inside interface. I have route map that route traffic from one inside ip to provider 2 and default route to provider 1. If I implement reverse path check, asa uses routing table as reference point and I have problem with traffic from provider 2. Is there a solution to this that is implementable on asa?

br

[tvotna]

You should not configure uRPF on ASA on those outside interfaces, because uRPF doesn't make any sense in this scenario. Both outside interfaces can be used to access any Internet IP address, hence traffic from any IP address can come back through both of the interfaces. In a certain sense this is equivalent to two default routes, so uRPF doesn't add any value here.

[MHM Cisco World]

you have asymmetric routing that why uRPF is drop packet 

[DraganSkundric87318]

i know about reason. just wanted to know if there is a way for asa urpf to be aware of pbr and see this as legitimate setup

[MHM Cisco World]

if you use ECMP then I think this issue will solve 

[tvotna]

Theoretically, PBR could mark flow to exempt returning packets from uRPF check, but this has never been implemented.

HTH

[MHM Cisco World]

Can you check NAT' if the traffic not NATing correctly then this can lead to asymmetric.

[Aref Alsouqi]

I don't believe there is a fix for that, however, if you want to send the traffic from a specific endpoint on the inside out of provider 2 why not to create a NAT rule for that specific endpoint and map it to the ASA interface connected to provider 2?

[DraganSkundric87318]

but urpf will still see return traffic from  internet IPs on interface 2 while routing table has route for them on interface 1 and reverse deny this traffic ... I guess

[MHM Cisco World]

No NATing is workaround that solve your issue'

The edge router without NATing

Have route to FW inside via two path and it select one that make urpf drop packet in FW 

If we NATing then edge router will send traffic to direct connect link and hence the FW recieve traffic in correct OUTside interface and urpf not drop traffic 

[MHM Cisco World]

I think he use FW behind Edge router and Edge router doing NATing, and I am with you NATing can solve issue here, 
instead of NATing only in edge router he can NATing to link between FW and Edge router and in Edge router he can NATing again from private to public. 
I ask him about NATing let see his answer 

[DraganSkundric87318]

i have edge routers toward both providers where I am doing NAT. ok, there is work arround to connect both providers to same asa interface and do some chemistry there and move urpf/async path from asa

[MHM Cisco World]

The issue not edge router with ISP

The isse is FW and edge router'

If we NATing in FW this make edge router forward traffic to correct direct connect link.

[Aref Alsouqi]

Alternatively, you can just remove the uRPF from the firewalls and configure an access list on the edge routers interfaces that are facing the ISPs to deny the incoming RFC1918 ranges allowing everything else. That will drop any private IP addresses in inbound and it won't affect VPN as the VPN traffic would be encrypted when it passes through the edge routers.

[ajwallace]

Did you try traffic zones? I believe that is one of the purposes of traffic zones but I could be wrong.