New ISP CONNECTED AND CHECK ONE VLAN NETWORK WHETHER INTERNET IS WORKING

[vishnuvichu36601]

WE CONNECTED NEW ISP INTERFACE TO OUR CISCO ASA.ALREADY WE HAVE 2 ISP IN ASA.WE CONFIGURE THE INTERFACE FOR NEW ISP AND WRITE NEW NAT POLICY FOR ONE VLAN NETWORK TO CHECK WHETHER INTERNET IS WORKING OR NOT,INTERNET IS NOT WORKING.

OUR NAT POLICY IS LIKE

SOURCE INTERFACE IS NEW ISP INTERFACE

SOURCE ADDRESS IS 172.18.*.*/24

DESTINATION INTERFACE IS ANY

DESTINATION ADDRESS IN ANY

DYNAMIC PAT

SOURCE ADDRESS TRANSLATION IS OUTSIDE ISP INTERFACE

PLEASE HELP US TO SOLVE THIS ISSUE.

[vishnuvichu36601]

in this configuration no need to add a static route for new isp and only
configure the interface for new isp and pbr, route map

[vishnuvichu36601]

route-map acl-name permit 1
match ip address "test-network"
match interface "new-isp-outside"
match metric 2
set ip next-hop "new isp"


is this configuration is ok??

[vishnuvichu36601]

interface gig0/1 <-- ingress interface of source traffic.

nameif inside

security-level 100

ip add 172.16.1.1 255.255.255.0 ====>ip address of ???

policy-route route-map access-test


while we configure this inside interface policy-route the other network
will effect this internet?
Where we configure the policy-route route map in asdm ?

[Marius Gunnerud]

Only the network that you define in the access-list will be affected by the policy-based routing configuration.

Check this link for configuration in ASDM

https://www.cisco.com/c/en/us/td/docs/security/asa/asa94/config-guides/asdm74/general/asdm-74-general-config/route-policy-based.html

[Marius Gunnerud]

This is not correct.  You are matching on two diferent interfaces at the same time which can never happen.  I proveded a sample configuration for you earlier.  here it is again.

access-list testACL permit ip 10.10.10.0 255.255.255.0 any

route-map access-test permit 10

  match ip address testACL

  set next-hop <IP of ISP2>

interface gig0/1  <-- This interface is the on closest to your inside network

nameif inside

security-level 100

ip add 172.16.1.1 255.255.255.0

policy-route route-map access-test

[vishnuvichu36601]

This configuration we can give only through cli not through asdm?

[Marius Gunnerud]

I provided a link to configuration in ASDM in my previous post.  here it is again.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa94/config-guides/asdm74/general/asdm-74-general-config/route-policy-based.html

[vishnuvichu36601]

• Set PBR next hop address—

• Set default next-hop IP address—

• Recursively find and set next-hop IP address—

• Configure Next Hop Verifiability—

need to configure new ISP address in all the address?

or

Only set PBR next hop-address ??

[Marius Gunnerud]

Only set next hop IP address in PBR is needed.  But you will need a NAT rule for this traffic.

Remember to apply the PBR to the ASA ingress interface, that is the interface where traffic from your LAN is entering.

[vishnuvichu36601]

During apply the PBR to the ASA ingress interface, that is the interface
where traffic from your LAN is entering

the other lan network Effect internet access.

Here we need to write an extended acl

access-list test permit ip test-network subnet any

[Marius Gunnerud]

Again, I have already provided you with an example config for you to get this working, twice now. There is an extended access-list in that example.

[vishnuvichu36601]

How to configure in inside interface policy-map

[Marius Gunnerud]

Policy-map? or PBR policy?  The PBR configuration is already provided.

[vishnuvichu36601]

interface gig0/1 <-- ingress interface of source traffic.

nameif inside

security-level 100

ip add 172.16.1.1 255.255.255.0 ====>ip address of ???

policy-route route-map access-test

how to configure this?

during this inside configuration other network will effect ???

[Marius Gunnerud]

Are you asking about interface configuration?  THAT IS JUST AN EXAMPLE!!!!!!

you should already have an interface configured.

Are you the administrator of this firewall?  If yes, your company desperately needs to send you on a training course.