I'm moving offices and redesigning how my network is built. One of the things I plan to do is put both of my internet facing ISPs onto my HA paired 5525X firewalls. Currently one ISP is servicing my internet through the firewalls and the other ISP is servicing S2S VPNs through an older c2900 router. It also acts as a backup INET connection in the event that the primary fails. I want to maintain that ISP as the VPN ISP and the INET ISP as they are, but both handled at the firewall.
Essentially configure the routing as
route outside 0.0.0.0 0.0.0.0 <INET ISP>
route outside 0.0.0.0 0.0.0.0 <VPN ISP> 100
My question is, will I need to do anything extra for the VPN ISP connection beyond doing the following config;
<crypto map config>
crypto map outside_map interface <VPN ISP INT>
I will also have the AnyConnect remote user VPN coming in on the INET ISP and remote users will need access to those S2S VPNs, would the following configs handle that interface moving;
same-security-traffic permit intra-interface
Will I need to add;
same-security-traffic permit inter-interface
?
Is there a best practice for this? Peeling the VPNs out of the ASA is doable, but with the c2900 out of SmartNet, the business wishes to move off of it. This would also provide a more fault tolerant solution and easier to add additional VPNs as required. Should I dig into doing some kind of tracking of the INET ISP instead of weighted routes?
