Manage PBR for return traffic to clients.

[_Ratha_]

Based on Diagram above:

Client computer accessing server with public IP address 2.2.2.10 through ISP2. I need the return traffic much be back with ISP2, but default AD to ISP1 is lower.

How to manage traffic to return to Client with origin ISP?

Thank,

Ratha

[Deepak Kumar]

Hi, 

It is possible with route-map (PBR).

Regards,

Deepak Kumar

[_Ratha_]

yes, but what option in PBR? how to apply this config?

[Deepak Kumar]

Hi,

Can you confirm clients ip are fixed one or dynamic or your server is reahable only through  isp2 from outside?

Regards,

Deepak Kumar 

[_Ratha_]

Clients from internet is dynamic IPs. Web server can reach via both ISPs.

[Georg Pauwen]

Hello,

which of the devices do you control ? If you control the ASA, you can set the routing there...

[_Ratha_]

On ASA firewall

[Georg Pauwen]

Hello,

try the below. Since policy routing is done before NAT, I think you should match on the internal address:

access-list WEBSERVER extended permit ip host 192.168.1.10 any
!
route-map TO_ISP1 permit 100
match ip address WEBSERVER
set interface FastEthernet0/1
!
interface FastEthernet0/1
policy-route route-map TO_ISP1

[_Ratha_]

Based on route AD, traffic is automatically to ISP1 but what I want is "traffic from internet to ISP2 IP address will return traffic via ISP2 to clients.

[Georg Pauwen]

Hello,

change the route map to:

access-list WEBSERVER extended permit ip host 192.168.1.10 any
!
route-map TO_ISP2 permit 100
match ip address WEBSERVER
set interface FastEthernet0/0
!
interface FastEthernet2/0
policy-route route-map TO_ISP2

[_Ratha_]

Based on this configuration, even traffic from ISP1 also return via ISP2. How to make traffic from ISP1 return via ISP1 and traffic from ISP2 return via ISP2?

[Georg Pauwen]

You can extend the route map to define which traffic you want to go where:

access-list WEBSERVER extended permit ip host 192.168.1.10 any

access-list OTHER extended permit ip any any

route-map TO_ISP permit 10
match ip address WEBSERVER
set interface FastEthernet0/0

route-map TO_ISP permit 20
match ip address OTHER
set interface FastEthernet0/1
!
interface FastEthernet2/0
policy-route route-map TO_ISP

[_Ratha_]

Assuming that web server 192.168.1.10 configure static NAT to IP 1.1.1.10(ISP1's IP) and 2.2.2.10(ISP2's IP). I need clients from internet with IP 5.5.5.5 access to web server by 1.1.1.10 via ISP1 will return traffic by ISP1, then again client 5.5.5.5 access the same web server via 2.2.2.10(ISP2) will return traffic via ISP2.

Thank

[Deepak Kumar]

Hi,

Is it static/ default route or dynamic routing? you configured different ad value for both isp. 

I need to check in the lab but you can archive your goal with correct routing and minor changing in load balancing feature. Again I need to test it in my lab. 

If anyone have idea please share.

Regards,

Deepak Kumar 

[_Ratha_]

Static default route is configured to both ISPs which default route will go through ISP1 is lower than static default to ISP2.