return path asa

[suthomas1]

can some experts help me in getting away with my confusion on below diagram.

  Internet ISP-1 -- ASA -- router -- ASA -- PIX(DMZ) ----ISP-2

there is a need to get one of the dmz web servers (currently reachable/used via ISP-2) to be used via ISP-1 only. but it may cause a proverbial problem when the return traffic from this server goes to the actual internet source, it may use ISP-2 which is not wanted.

My need is to have this server traffic to be used only via ISP-1. i will do static nat on ASA for this web server, but since source will still be seen as public ip on the devices , it is a bit confusing & trying to find fix.

please help in possible ways of doing this.

Thanks in advance.

[Federico Coto Fajardo]

Hi,

The problem that I see is that if the default gateway for that server is the PIX, and if the PIX has a default gateway to ISP-2, then all traffic will be sent out using that connection. In other words, traffic intended to the internet will always be sent out via ISP-2 by the PIX.

The PIX won't support PBR (Policy Based Routing) to allow this particular server to be sent out via ISP-1.

Please clarify/confirm your topology, so we can perhaps recommend a solution.

Federico.

[suthomas1]

Yes exactly, that is the concern here.

This server is in pix's dmz. i want all internet user request for this server to enter through ASA-1 via ISP-1 , reach all the way to this server in DMZ. And follow the same path back while returning.

Internet ISP-1 -- ASA-1 -- router-- (WAN link)--router-- ASA-2 -- PIX(DMZ) ----ISP-2

let me know if query is not clearly put by me.

[Federico Coto Fajardo]

Ok, the question is...

Where's the default gateway of the devices?

For example, the default gateway of the PIX is ISP-2 correct?

If so, the defaut gateway of ASA-2 is the PIX or goes out via ISP-1?

If ASA2 goes out ISP-1, one option is to connect the DMZ server to a DMZ on the ASA and allow it to get out via ISP-2 as you intend.

Federico.

[Jigar Dave]

Hi Thomas,

can you provide some details from your side to help you better?

1. you are using ASA at one side and PIX at other side, can you use either of them ( all ASA or all PIX)

2. you have connected ISP2 with PIX DMZ but in general practise, internet is connected with outside interface of security device which is having security level 0, why you have connected like this?

-- Jigar

[suthomas1]

Thanks Federico,

Internet ISP-1 -- ASA-1 -- router-- (WAN link)--router-- ASA-2 -- PIX(DMZ) ----ISP-2

Yes, gateway for PIX is ISP-2 & gateway for ASA-2 is PIX, so currently ASA-2 default path can only go out via ISP-2.

apologies , it seems my post ain't clear & causing confusions. I will elaborate more with few ip's.

server A (192.168.100.10) is located at DMZ of PIX.

ASA-1 segment is 192.168.200.xx

I want traffic for server A ( 192.168.100.10 ) to enter via ISP-1 , reach to DMZ in PIX & return back to the original public source via ISP-1.

below are some lines which i'll be putting on for partial achievement of this:

re-registering the server A with domain corresponding to ISP-1 public ip's.

static nat on ASA-1 for 192.168.100.10, route to allow it towards dmz.

route on pix to reach 192.168.200.xx address on ASA-1.

I am looking to get requests for Server A to enter through ISP-1, ASA-1 & response from server A for same public flow to be out back via ISP-1.

Hope this gives more clarity.

Thank you.

Jigar,

dmz connection was only a diagram view, pix outside goes to internet.

[praprama]

Hi,

Internet ISP-1 -- ASA-1 -- router-- (WAN link)--router-- ASA-2 --  PIX(DMZ) ----ISP-2

Theoretically, it is possible to achive the above by NATing the users to the inside IP address of ASA1 (192.168.200.xx). So you will basically need config like below on ASA1:

access-list TEST permit ip any

nat (outside) 2 TEST outside

global (inside) 1 interface

So if you configure the routing as you mentioned (appropriate routing on PIX to reach 192.168.200.xx), the return packets hould be forwarded to ASA1. You can replace the "interface" keyword with a free IP in the 192.168.200.xx segment as well.

One problem we might run into here is all the internet users coming into the ASA1 accessing the SERVER are going to be PATed to an internal IP. It is possible that we might exhaust the PAT IP address if there are going to be a lot of clients connecting to the server in which case you will need a lot of IP address allocated for PAT.

Let me know if this is clear enough or if there are any questions.

Thanks and Regards,

Prapanch

[suthomas1]

Hi,

Thanks, but are the below lines for getting users coming from public internet to be natted to inside?

access-list TEST permit ip any 192.168.200.20

nat (outside) 2 TEST outside

global (inside) 1 192.168.200.20

i was thinking of putting a static statement for natting the public request to this server on asa-1. isnt that correct?

i appear to have not understood your good suggestion properly. Would help if detailed a bit, i'am confused a bit.

thanks.

[praprama · Accepted solution]

Hi,

Yes the NAT commands i mentioned are to NAT the clients trying to access the server coming in on ISP-1. But the way the NAT should be configured is as below.

It is still needed to translate the server to a public IP on ISP-1. Assuming your server is translated to ISP-1 on ASA1 to the public IP a.b.c.d. So the static would be

static (inside,outside) a.b.c.d 192.168.100.10

The NAT commands needed to NAT the clients trying to access the server using the public IP a.b.c.d would be as below:

access-list test permit ip any host a.b.c.d

nat (outside) 2 access-list test outside

global (inside) 1 192.168.200.20

(Based on your above post i am assuming the free IP address the clients are going to be NATed is 192.168.200.20)

When this happens, the packets that reach your server will be sourced from 192.168.200.20. So if your routing is setup appropriately on the PIX, the replies from the server should be sent back to ASA1 which should then take care of the NATing before sending the reply back out to the clients.

Hope this clears out the doubts you had.

Cheers,

Prapanch