Need Help for configuring Floating static route in My ASA.

roopesh.n · ‎10-18-2012

Hi All,

I need your support for doing a floating static route in My ASA.

I have tried this last time but i was not able to make it. But this time i have to Finish it.

Please find our network Diagram and configuration of ASA

.................

route outside 0.0.0.0 0.0.0.0 6.6.6.6 1 track 1

route outside 0.0.0.0 0.0.0.0 6.6.6.6 1

route rOutside 0.0.0.0 0.0.0.0 3.3.3.3 10

route inside 10.10.4.0 255.255.255.0 10.10.3.1 1

route inside 10.10.8.0 255.255.255.0 10.10.3.1 1

route inside 10.10.9.0 255.255.255.0 10.10.3.1 1

route inside 10.10.15.0 255.255.255.0 10.10.3.1 1

route rOutside x.x.x.x 255.255.255.255 5.5.5.5 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 10.10.3.77 255.255.255.255 inside

http 10.10.8.157 255.255.255.255 inside

http 10.10.3.59 255.255.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

sla monitor 123

type echo protocol ipIcmpEcho 8.8.8.8 interface outside

num-packets 3

frequency 10

sla monitor schedule 123 life forever start-time now

crypto ipsec transform-set cpa esp-3des esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto map vpn_cpa 1 match address acl_cpavpn

crypto map vpn_cpa 1 set peer a.a.a.a

crypto map vpn_cpa 1 set transform-set abc

crypto map vpn_cpa 1 set security-association lifetime seconds 3600

crypto map vpn_cpa interface outside

crypto isakmp identity address

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash md5

group 2

lifetime 86400

crypto isakmp policy 65535

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

!

track 1 rtr 123 reachability

telnet 10.10.3.77 255.255.255.255 inside

telnet 10.10.8.157 255.255.255.255 inside

telnet 10.10.3.61 255.255.255.255 inside

telnet timeout 500

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics port

threat-detection statistics protocol

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ntp server 10.10.3.14

webvpn

tunnel-group .a.a.a.a ipsec-attributes

pre-shared-key *

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

!

service-policy global_policy global

smtp-server 10.10.5.11

prompt hostname context

Cryptochecksum:eea6e7b6efe5d1a180439658c3912942

: end

i think half of the configuration stil there in the ASA.

Diagram.

Thanks

Roopesh

Javier Portuguez · ‎10-18-2012

Hi Roopesh,

Checking I see the same route twice:

route outside 0.0.0.0 0.0.0.0 6.6.6.6 1 track 1

route outside 0.0.0.0 0.0.0.0 6.6.6.6 1

On the other hand, what exactly is not working?

Thanks.

Portu

Please rate any helpful posts.

roopesh.n · ‎10-18-2012

Hi Portu,

Thanks for the replay

I am really forget raise my issue.

Here it is As we sow in the diagram we have two ISP. So we have pointed our default route to ISP1(6.6.6.6 Primary ISP).and it is working fine .and we have secondary Link to ISP2 we need to configure this as our backup link. Once the ISP1 fails the traffic should be routed to ISP2 automatically. i think i can accomplish this by doing IP SLA and Floating route but I am not sure about the complete configuration and I am new to ASA.

Thanks

Roopesh

Javier Portuguez · ‎10-18-2012

Roopesh,

Please make the following change:

no route outside 0.0.0.0 0.0.0.0 6.6.6.6 1

Are planning to NAT any traffic on this ASA?

Thanks.

Portu.

Please rate any helpful posts

roopesh.n · ‎10-18-2012

Portu,

We have Some ststic NAt for our DMZ server and a gloabal nat for all.

global (outside) 101 interface

nat (inside) 101 0.0.0.0 0.0.0.0

I have removed the route route outside 0.0.0.0 0.0.0.0 6.6.6.6 1

Thanks

Roopesh

saurabhgoel169 · ‎10-19-2012

You have missed the last command in your configuration, Please check it again

route ISP1 0.0.0.0 0.0.0.0 6.6.6.6 track 1
route ISP2 0.0.0.0 0.0.0.0 3.3.3.3

sla monitor 10
type echo protocol ipIcmpEcho 8.8.8.8 interface ISP1

num-packets 3
frequency 10
sla monitor schedule 123 life forever start-time now
track 1 rtr 123 reachability

You can do NAT in same way, here the logical name of the interface will be different.

Share the result

Please rate any helpful posts.

roopesh.n · ‎10-19-2012

Hi Saurabh,

I have already given the track.

Please refer my first configuration.Can you explain little more about NAT ing part for this

Thanks,

Roopesh