Hello Ambivert skill,
you and your colleagues have opened three different threads on the same issue.
I have answered to two of them wasting my time before realizing it was exactly the same scenario!
The third thread has been answered by somebody else.
However, I try to provide some feedback on this thread.
a) in your case you have a L2 port to the ASR 1000 device that before introduction of the transparent FWSM is associated to Vlan 170.
But is Vlan 170 in a different routing table then the the subnet 192.168.2.0 or you are using PBR to divert traffic to ISA server?.
In any case the way you would like to introduce the transparent FW looks like correct.
b) in your case you don't need an SVI in new Vlan 120 the L3 peers will be SVI 170 on inside and the external ASR
1000 device interface out of gi9/44.
So you don't need to modify any source MAC address
c) to be checked on configuration used on the field
I see the following on a FWSM used in transparent mode
access-group BPDU in interface inside
access-group acl_inside in interface inside
access-group BPDU in interface outside
access-group acl_outside in interface outside
where acl_inside and acl_outside are L3 IP ACL and BPDU ACL has the following configuration
access-list BPDU ethertype permit bpdu
actually the ACL permits STP BPDUs it does not block them, as I wrote I had to check, my memory failed in this case.
So actually it is the opposite to be sure to build loop free topologies the STP is allowed to flow.
This does not apply to your scenario as you have a single box, in my case I had two C6500 boxes with each one having its own FWSM with a transparent FW context interconnecting two VRFs.
d)
you route between SVI vlan 170 and the ASR 1000 interface
#VLAN 170 IP(192.168.1.10) is mentioned on ISA external interface as a Default Gateway on it.
this is fine
e)
# We define route map name NAT and match it with Extended ACL 101 and define the next hop address which is my ASR IP for all traffic that match with ACL 101 and put this PBR on my SVI Interface VLAN 170
the MAC address of the ASR 1000 will be learned via the transparent FWSM
I would expect a default route pointing to the ASR 1000 address instead of this PBR rule but it should work also with this setup.
I would put SVI Vlan 170 in a separate VRF in comparison to the interface that connects to the inside of the ISA
In this way routing outbound to the internet would just follow the default route in each routing table
in global routing table a default route pointing to the ISA server, the ISA server will have a static route pointing to the C7513 that in the upper part of your network diagram for all internal networks.
in VRF TOFW a default route pointing to the ASR 1000 interface and a static route pointing to the NAT pools using as nexthop the external ISA server IP address.
In this scenario you may need to disable ICMP redirects
By using a VRF on the 6513 you can avoid to use PBR rules.
final note: if your C6513 has a Sup720 supervisor you should consider to implement NAT directly on it without using the external ISA server, but I understand there may be other reasons even not technical for this scenario (the ISA server may be administered by a different working group then yours that wants to keep control on internet access)
Hope to help
Giuseppe
