Dual WAN Configuration on ASA 5506-X

[Zaleon]

Hello All,

     I recently moved to a more rural area and have to utilize LTE cellular as my primary internet connection. I have 2 accounts with 1 being in my Cisco C819G LTE router and the other is a Netcomm IFWA-40 that I also use for voice service. I also recently added 2 GL.inet GL-MV1000 VPN routers to my setup to keep my LTE connection from being throttled.

My current setup looks something like Cisco 2980G Switch -> Cisco 3650 Switch -> Cisco ASA 5506-X -> GL-MV1000 Router -> Cisco C819G Router -> Internet. I have 7 VLANS configured on the switches for various devices.

The Netcomm IFWA-40 currently operates as a standalone device and network, but I'd like to hook it to one of the extra interfaces on the ASA.

My question is, is it possible to split my VLAN traffic going out to the Internet over both of these connections if both routers are connected to the ASA?

Essentially I want to do manual load balancing and I don't care about redundancy.

My ultimate goal would be to route VLANS 20 and 50 over the Netcomm IFWA-40 then have everything else route over the Cisco C819G router, but I'm not sure how to edit my current config to make that happen or if its even possible.

My current config is attached. DMZ1 and 2 can be ignored, I was experimenting with them a while back and just never took them out of the configuration.

[MHM Cisco World]

use PBR to make specific traffic take one path and other take other path.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa94/config-guides/cli/general/asa-94-general-config/route-policy-based.html

[Georg Pauwen]

Hello,

not sure I fully understand your current configuration, as their is no 'route outside' at all ? Either way, you (obviously) need another outside interface, and then the configuration below should work:

access-list VLAN_20 permit 10.20.1.0 255.255.255.0
access-list VLAN_50 permit 10.50.1.0 255.255.255.0
!
route-map ISP_RM permit 10
match ip address VLAN_20 VLAN_50
set interface outside
!
route-map ISP_RM permit 20
set interface outside2
!
interface GigabitEthernet1/2
policy-route route-map ISP_RM
!
route outside 0.0.0.0 0.0.0.0 x.x.x.x
route outside2 0.0.0.0 0.0.0.0 y.y.y.y

[Zaleon]

Hi Georg,

    Thanks for your reply, that is correct. Some how I deleted the outside route when I was sanitizing it, so good observation.

The only outside route I have currently is "route outside 0.0.0.0 0.0.0.0 10.0.0.1 1" which is normally just above the inside routes.

So for your configuration changes, I just need to add that information and the additional outside route, I don't need to change anything else existing in the configuration?

[MHM Cisco World]

need NAT from inside to new outside2 

[Zaleon]

Yes I thought it needed another NAT statement. So I was able to add most of the commands Georg suggested above plus the NAT statement, but I'm getting an error when trying to add a new route for outside2. Regardless of which IP address I try to use.

These are the existing routes.

[Georg Pauwen]

Try and add the route like this:

route outside2 0.0.0.0 0.0.0.0 192.168.1.1 10

[MHM Cisco World]

only one default route with same AD can add

change the AD 

route ............. 2<-this add and check 

[Zaleon]

Well 10 or 2 works, but when I switch over to VLAN 20 or 50, it is still showing the same public IP as the other VLANs, so I don't think it is working. They should be different public IPs if it is routing 20 and 50 to outside2. Any ideas?

Latest config with changes above is attached.

[MHM Cisco World]

First clear xlate and conn table

second try connect from these vlan again 

[Zaleon]

Well it still seems to be operating in a fail-over setup, which is not what I wanted it to do.

I tried clearing the xlate, connections along with my cache and flushing my DNS this morning, but nothing made a difference, it still showed connection 1/1 being used.

When I went to my ASA and unplugged connection 1 (gigabit1/1), after 3-4 minutes it finally switched over to ISP2 (gigabit1/2) and was showing that public IP address when I go to what is my ip? As soon as I plugged gigabit1/1 back in it switched back over to that connection.

I don't really understand that since as far as I know I don't have anything in my configuration that is tracking the health of the connections, unless the ASA automatically does that.

[Georg Pauwen]

Hello,

you have applied the route map to the outside interface, it needs to be applied to the inside:

interface GigabitEthernet1/2
description "WAN Connection to IFWA-40"
nameif outside2
security-level 0
ip address 10.1.1.2 255.255.255.0
--> no policy-route route-map ISP2
!
interface GigabitEthernet1/3
description "LAN Connection to Cisco 3650 Switch"
nameif inside
security-level 100
ip address 10.5.1.2 255.255.255.0

-->  policy-route route-map ISP2

[MHM Cisco World]

[MHM Cisco World]

friend clear late and conn before test again 

[Zaleon]

Hmmm well it seems I can't win, now it is doing the opposite, it routing everything over gigabit1/2 (ISP2). I've been testing with VLAN10, 20 and 50 with a different web browser to find the public IP, so its defiantly not a caching issue or anything.

I also couldn't get the ASA to accept an extended ACL for that route-map policy, it gets an error.

The only other access-list in there is an extended ACL for the firepower module.