How to exit internet one vlan by diferent port

[luisdivar]

Hi Community. I have one switchcore and two ASA's. Each ASA has own link to internet and also each ASA connect to a different ISP.

I want to exit one vlan through one ASA and the other vlans by the other ASA. How can I do that?

Regards.

[Deepak Kumar]

Hi,

Please past following configuration on your switch :

!
!
!

ip routing!
!
interface FastEthernet0/1
description connected to ASA 1
switchport access vlan 2
!
interface FastEthernet0/2
description connected to ASA 2
switchport access vlan 3
!
interface FastEthernet0/3
description connected to PC 1
switchport access vlan 10
!

interface FastEthernet0/4
description connected to PC 2
switchport access vlan 20

!

!

!
interface Vlan2
description connected to ASA1
ip address 10.0.0.1  255.255.255.252
!
interface Vlan3
description Connected to ASA 2
ip address 10.0.1.1  255.255.255.252
!
interface Vlan10
description connected to PCs
ip address 192.168.10.1 255.255.255.0
!

interface Vlan20
description connected to PCs
ip address 192.168.20.1 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.0.0.2
ip route 0.0.0.0 0.0.0.0 10.0.1.2 2
!
!

Regards,

Deepak Kumar

www.deepuverma.in

[luisdivar]

Hi Deepak, thank you for your answer.

I have one more question. Sorry for the ignorance, but I don´t know what configuration I have to do in the ASA, can you help me with commands?

Thank you a lot Deepak.

Regards

[mvsheik123]

Hi,

You can use PBR (Policy based routing on switch) to control the path. Google for PBR examples.

hth

MS

[Deepak Kumar]

Hi,

Your welcome, Here I am going to make ASA1 configuration :

interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1

switchport access vlan 1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 0
ip address 200.150.75.2 255.255.255.252
!
interface Vlan2
nameif outside
security-level 100
ip address 10.0.0.2 255.255.255.252
!
object network ASA-SW0
subnet 10.0.0.0 255.255.255.252
object network VLAN10
subnet 192.168.10.0 255.255.255.0
object network VLAN20
subnet 192.168.20.0 255.255.255.0
!
route outside 0.0.0.0 0.0.0.0 200.150.75.1 1
route inside 192.168.10.0 255.255.255.0 10.0.0.1 1
!
access-list LAN extended permit tcp any any
access-list LAN extended permit udp any any
access-list LAN extended permit icmp any any
!
!
access-group LAN in interface inside
object network ASA-SW0
nat (inside,outside) dynamic interface
object network VLAN10
nat (inside,outside) dynamic interface

object network VLAN20
nat (inside,outside) dynamic interface
!
!
!

-------------------

If you are on real ASA then please replace NAT rules as below:

nat (inside,outside) after-auto source dynamic any interface

Please vote to correct answer.

Regards,

Deepak Kumar

www.deepuverma.in