multiple default route in ASA

[moussa.malqui1]

Hi all,

How ca i define multiple default route in ASA?

route tcvpn 0 0 10.240.20.1

route cacvpn 0 0 10.240.30.1 

whaen i put the second route i get this route is aleready exisit. what is the solution?

[Marius Gunnerud]

It is correct that you would access the service using 10.240.2.28 instead of 10.240.1.28.  But NAT would need to be done on the router and not the ASA.  Or optionally you could do the NAT at the remote side.

--

Please remember to select a correct answer and rate helpful posts

[moussa.malqui1]

I defined this NATed ip address but i didn't get access to ressources services in remote site, in the router isp the vpn link is etablished to the remote site, but my objectif is to get access to the services 10.240.1.28 by two gatway 10.240.20.1 for tcvpn and 10.240.30.1 for cacvpn any solution i can put in my asa?

[Marius Gunnerud · Accepted solution]

Sorry for the late reply as I have been quite busy lately with work and family.

The only option then is to enable tcp bypass or traffic zone for ECMP to account for asynchronous routing.  Only using traffic zones will allow you to have multiple routes to the same destination with the same metric.

--

Please remember to select a correct answer and rate helpful posts

[moussa.malqui1]

Thanks Marius, but how can i NAT those services at one of the site, can you explain more? whatis commands i should put?

[Marius Gunnerud]

Since both VPNs are terminated on the same router you will need to do the NAT on the router and not the ASA.

--

Please remember to select a correct answer and rate helpful posts

[Karsten Iwen · Accepted solution]

I'm not sure what you really want to achieve, but it's very likely that PBR is the solution.

[moussa.malqui1]

thanks Karsten but how can i define it in my ASA version 9.2?

[Marius Gunnerud]

If you want to use PBR, though I do not believe this will solve your problem, you will need to upgrade to version 9.4(1) or higher.

--

Please remember to select a correct answer and rate helpful posts

[Marius Gunnerud]

Check your other post.  You need to setup static routes for the remote VPN subnets.  If there are many remote subnets I suggest summarizing them.

Although, zoned ECMP would allow you to setup default routes pointing out each interface, the problem you will run into is that traffic will be load-balanced across these interfaces, meaning traffic that is destined for VPN1 might be sent out the wrong interface.

--

Please remember to select a correct answer and rate helpful posts

[moussa.malqui1]

thanks Marius but when i setup static routes for the subnet i get "error this interface is directly connected"

[Marius Gunnerud]

You need to define the remote network not the network connected to the ASA interface.  To be more specific, the network at the remote side of the site to site VPN tunnel.

--

Please remember to select a correct answer and rate helpful posts

[moussa.malqui1]

thanks Marius i understand what you say . so i think i will put  zoned ECMP because i don't have the address ip for site to site VPN i should contact the provider

[Marius Gunnerud]

As mentioned earlier zoned ECMP will not solve your issue as this will just load-balance the traffic over the interfaces.  That means that traffic for one VPN site could be sent out the wrong interface.  to solve your problem you MUST get the remote site adresses and enter static routes. 

But is the site to site VPN terminated on the ASA or the ISP router?

--

Please remember to select a correct answer and rate helpful posts

[moussa.malqui1]

the site to site VPN terminated on the ISP router 

[moussa.malqui1]

thanks Marius