Route Internet Traffic to Second ASA

[jeff6strings]

We have an existing ASA which handles our Internet and inbound from the Internet static NAT'd SFTP, SIP and Web Server traffic. We want to add a second ASA which the existing ASA would forward 0.0.0.0 Internet bound traffic to this new ASA. When doing this we want to keep the inbound SFTP, SIP and Web Server traffic on the existing ASA. Attached is a diagram of what we would like to achieve and I appreciate any recommendations and help.

Jeff

[moishaq]

Hi Jeff,

Yes, it is possible you can connect to the internal server SFTP, SIP, Web Server via Static NAT on the ASA1 and can connect to the internet from the ASA2 where you will configure default route towards the internet.

Regards,

Mohammad Ishaq

[jeff6strings]

I assume its as simple as specifying a 0.0.0.0 0.0.0.0 static route pointing to ASA2? We are concerned about asymmetrical routing, for example SFTP will come in on ASA1 but leave on ASA2.

Thank you.

Jeff

[moishaq]

 Hi Jeff,

Yes, It is possible that we can have the asymmetric routing but we can overcome that through configuring PBR on the ASA1 to route the internal server traffic.

Regards,

Mohammad Ishaq

[jeff6strings]

I would greatly appreciate an example policy to get me started for research and I will then test in a lab.

Thanks again.

Jeff

[moishaq · Accepted solution]

First, we need to configure interfaces.

ciscoasa(config)# interface GigabitEthernet0/0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# nameif inside
ciscoasa(config-if)# ip address 10.1.1.1 255.255.255.0

ciscoasa(config)# interface GigabitEthernet0/1
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# nameif outside-1
ciscoasa(config-if)# ip address 192.168.6.5 255.255.255.0

ciscoasa(config)# interface GigabitEthernet0/2
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# nameif outside-2
ciscoasa(config-if)# ip address 172.16.7.6 255.255.255.0

Then, we need to configure an access-list for matching the traffic.

ciscoasa(config)# access-list acl-1 permit ip 10.1.0.0 255.255.0.0
ciscoasa(config)# access-list acl-2 permit ip 10.2.0.0 255.255.0.0

We need to configure a route-map by specifying the above access-list as match criteria along with the required set actions.

ciscoasa(config)# route-map equal-access permit 10
ciscoasa(config-route-map)# match ip address acl-1
ciscoasa(config-route-map)# set ip next-hop 192.168.6.6

ciscoasa(config)# route-map equal-access permit 20
ciscoasa(config-route-map)# match ip address acl-2
ciscoasa(config-route-map)# set ip next-hop 172.16.7.7

ciscoasa(config)# route-map equal-access permit 30
ciscoasa(config-route-map)# set ip interface Null0

Now, this route-map has to be attached to an interface.

ciscoasa(config)# interface GigabitEthernet0/0
ciscoasa(config-if)# policy-route route-map equal-access

To display the policy routing configuration.

ciscoasa(config)# show policy-route
Interface                   Route map
GigabitEthernet0/0   equal-access

[jeff6strings]

Mohammad:

I assume the 10.1 and 10.2 networks are where our SFTP, SIP, Web servers are and I can replace the subnets with individual IP addresses of the servers?

Thanks for all the help.

Jeff

[moishaq]

Hi Jeff,

Yes, You got it right. That will route the traffic towards the next desired interface.

Regards,

Mohammad Ishaq

[jeff6strings]

Thank you.

[moishaq]

Welcome!

Please rate helpful and mark correct answers