Trying configure ASA5505 (8.4) to allow https on two WAN ports at same time

[Steve Dixon]

I have an ASA 5505 running 8.4.4.1.  I've configured three WAN interfaces and have assigned failover on one of them (we have two ISP's, and a total of 3 static IP's in 3 different subnets).  I've noticed that all the traffic is flowing through only one of the three interfaces, but I need to allow incoming https traffic on the second WAN port so I can access our Exchange server (we already use https on the first WAN port to access another server).

Let me know if posting the config would be best (not sure of the protocol for that yet).

Simple example:

-e0/0 = vlan1 = WAN1 (1.2.3.4/30)

-e0/1 = vlan2 = WAN2 (2.3.4.5/30)

-e0/2 = vlan3 = WAN3 (3.4.5.6/30)

-e0/3 = vlan4 = LAN1 (192.168.10.0/24)

-e0/4 = vlan4 = LAN1

-e0/5 = vlan5 = LAN2 (10.0.0.0/24)

-e0/6 = vlan5 = LAN2

-e0/7 = vlan5 = LAN2

Failover configured between WAN1 and WAN3 (WAN1 and WAN2 connect to the same cable modem).

Exchange server (OWA): 10.0.0.208

RDS Gatewat server: 10.0.0.211

WAN1 is the default outgoing route and we've configured several incoming services on it (smtp and https for example) and appears to be working properly as mail is coming and going and users can access the RDS gateway.

I need to configure WAN2 to accept https traffic and send it to our Exchange server to enable OWA (webmail) access.

I've configured the same Access and NAT rules on all three WAN interfaces  for smtp (but I suspect only the first one is currently functioning at  this point, I'll test it next chance I get).

I thought all I'd have to do is configure an access and NAT entry on WAN2 (same as on WAN1), but direct the traffic to the OWA server instead of the rds gateway server, but it is not working.

In the realtime log I can see that it appears to be receiving the traffic on the WAN2 IP, but seems to be passing this through to the inside via the WAN1 interface.

3    Sep 15 2012    12:16:10    710003    <sourceIP>    60775    <WAN2IP>    443    TCP access denied by ACL from <sourceIP>/60775 to WAN1:<WAN2IP>/443

[Jennifer Halim]

The reason why it's working for WAN1 is because you can only have 1 active default route on an ASA firewall. That is why WAN2 is not working.

If you move the default route to WAN2 it will also work, and WAN1 will stop working.

Unfortunately ASA only allows 1 active default route via 1 interface, not multiple interfaces.

[Steve Dixon]

I suspected as much, but that puts me in a tough spot as I've got two services that work on port 443 and neither can be changed to use another port.  The OWA access is used by smart phones (no option to set/change the port) and the RDS Gateway does not support alternate ports (design restriction).

I was previously informed because the WAN1 and WAN2 IP's were not in the same subnet I had to use two different interfaces. 

Is there a way to achieve the desired result of being able to receive on multiple IP's/interfaces concurrently?

[Marvin Rhoads]

Can the RDS Gateway clients use a port of than tcp/443? If so, then put a PAT in place for the public IP of RDS and use that port.

Alternatively, you could get your ISP to parcel out more than the /30 you currently have (with only 2 usable IP addresses - your end and theirs). Most folks with ASAs have at least a /27 or so to allow at least a handful of public IPs to be set up -whether for NAT or PAT use.

[Steve Dixon]

The IP's we were assigned are next to each other:

a.b.c.68/30 (.69 as theirs and .70 as ours)

a.b.c.72/30 (.73 as theirs and .74 as ours)

I may be able to get the ISP to combine them into a /29 group of consecutive usable IP's, but that will take some time to coordinate.

FYI, the ASA is replacing an old SonicWall TZ170 and it was able to use the two public IP's we were assigned (using a static ARP entry and NAT rule using the WAN2 IP I think).  I'm a bit dismayed the ASA cannot do this too (or maybe it can and I just cannot figure out how).  The TZ is being replaced due to EOL issues (cannot renew the support contract for it), and we got the ASA via techsoup (for registered charities).

Unfortunately Microsoft did not design the RDS gateway service to work with ports other than https (I already confirmed this with Microsoft support).  My understanding is it is a hard coded limitation (the RD Client gateway field does not support port specifications, just an FQDN DNS name).  Hopefully they add a port field by Server 2016/Windows 9.

Until I can get the IP's merged I think I'll install the old TZ170 to take over the OWA incoming traffic.

[Steve Dixon]

Okay, logged a TAC and got it working:

In this instance the only thing that needed to be changed was the NAT rule.

My original rules were interface rules, which only worked on the default route (WAN1).  Setting the "outside" value to the WAN2 interface fialed.

The NAT rule for the second https service was modified to use the IP of WAN2 (changed from WAN2 interface to WAN2 IP), now it is working.

I didn't check the logs but I suspect the traffic still flows out the WAN1 interface to the modem (shared by WAN1 and WAN2 interfaces), but since the modem is expecting traffic on that IP it does not reject it.  I could be wrong though.

Technically, I don't think I even need the WAN2 interface configured anymore as the NAT rule would rewrite the packets out the active port.  Without a second failover IP from the second ISP we can still only provide failover redundancy for one of the https services though.

Will post the two https NAT rules for the community next chance I get (in case any one else has to do something similar).