10-06-2015 09:36 AM - edited 03-11-2019 11:42 PM
All,
Thank you in advance for taking the time to read. Security is not my strength and I need to know if this is even possible.
I am migrating to a new ISP and New FWs, I setup the new link and firewalls parallel. I already have the new ISP and new FWs configured and I have internet access. I thought I could change the default route on the core switch to point to the new FWs and therefore to the new ISPs, however, when do this my servers are not responding to outside requests. Inside clients like computers can get online but my web servers are down.
My plan was to use the new ISP for outbound and slowly migrate the servers to the new ISP block by changing the external DNS and NATTING through the new FWs.
Is this scenario possible assuming the FWs are configured properly?
Topology:
NEW ISP
(IP block 209.x.x.x) ===> New ASA ==
==== core ===== clients
OLD ISP ==== switch =====and servers
(IP Block 63.x.x.x)====> OLD ASA ==
NATs to
Inside Servers
Thanks in advance.
FG
10-07-2015 02:53 AM
That plan should work. You just need to be careful that you do not route any traffic from the servers out to the internet through the NEW firewall before the NAT and ACL rules have been migrated across. You may create an ASYMMETRIC routing scenario and State tables won't match, and traffic will be dropped.
10-15-2015 06:20 AM
Hi,
If you want to migrate the servers one by one I can suggest to use policy based routing (if supported) on Core switch. You can change the default route for only particular server (source based) towards the NEW firewall. Before that you have to migrate all ACLs and NAT rules off course.
Regards,
Ergin
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide