New implementaion

[vipinrajrc]

Hi Experts,

I need to implement the following scenarion in one of my clients.

I am having so much regarding this please help

My needs are

1) Configure the attched scenario

2) Internet must be up and running

3) Make the servers publically available (NAT)

4) Make a good security

5) Do the failover mechanism

6) Create IPVPN to other 5 sites.

-------------------------------------------------------------------------

from the figure it is clear that there is two ISP connection. ISP connection terminates only at the router2851.

Please suggest if the followings are right or not?

I)   So for internet connection i need to configure

a) Default route in 2851router

b) Default route from ASA5510 to router's interface that is connecred to ASA

c) PAT from ASA's inside private addresses to ASA's outside private address

d) Then another PAT from ASA's outside interface to router's WAN interface.

Do i need to configure anything for make internet UP for the internal network.

II)  Static NAT of servers inside the ASA's inside interface

a) Since the servers are two hops away from router's WAN interface is it possible to do a static NAT from the ASA itself?

b) or   Do i need to configure NAT in router? if it so how can i configure that.

III) Failover mechanism

  a) is RTR configuration is enough for this ISP switching? or do i need to configure BGP or something Please advice i've no idea in this

IV) IPVPN to multiple sites

  a) from the ISP's website it is showing IPVPN is related to MPLS, So do i need to configure anything from our side? or ISP will do this?

initially i thought it was similar to site-to-site vpn.

Also for failover of wan interface do i need to create NAT and default route for each interface ???

Please provide your suggestions also find the attachment.

Thanks and regards

Vipin

[Vaibhava Varma]

Hi Vipin

I have the below inputs on the above traffic requirement:

Please suggest if the followings are right or not?

I)   So for internet connection i need to configure

a) Default route in 2851router

   Yes two default routes will be required one each for the respective ISP connection. Depending upon which ISP connection we need to make Secondary for Failover we need to increase the AD of that default route.

b) Default route from ASA5510 to router's interface that is connecred to ASA

    Yes we wiil need a default route from ASA towards router to send the traffic out from the router to Internet.

c) PAT from ASA's inside private addresses to ASA's outside private address

   Yes this PAT would save the reverse route requirement on the router to reach the Internal LAN Subnets

d) Then another PAT from ASA's outside interface to router's WAN interface.

      I don;t think this PAT is needed as its the router which is connected to Internet via Public IPs so NATTing (PAT) would be done on the router but since here we have two paths available to go out this is little tricky as we want Active:Standy mode of operation we need to do the PAT based on the NAT Pool and not outgoing interface. Are the ISPs allocating you Public Subnets or not apart from the Peering Connectivity. What we need is to have atleast one Public IP Block assigned from any of the ISP and route the same via both ISPs and the PAT would be done via this Public IP Pool so as long as one of the ISP link is UP the PAT would still work independent of which ISP Link is UP.

We need to make sure that the Public IP Pool assigned is routed via both ISPs to Internet and announced as less preferred via secondary ISP .

Do i need to configure anything for make internet UP for the internal network.

No from my understanding nothing needs to be done for the Internal Network as PAT is being used for the ASA.

II)  Static NAT of servers inside the ASA's inside interface

a) Since the servers are two hops away from router's WAN interface is it possible to do a static NAT from the ASA itself?

Since we are already doing PAT on the ASA for the Internal LAN I don't think we can do Static NAT for them or may be we can do selective Static NAT on ASA and Selective PAT on the ASA.

b) or   Do i need to configure NAT in router? if it so how can i configure that.

Yes PAT needs to be configured on Router for Internet Access to LAN

III) Failover mechanism

  a) is RTR configuration is enough for this ISP switching? or do i need to configure BGP or something Please advice i've no idea in this

FLoating Static Route will provide the required the Switching for the Default route for Internet as explained above.

IV) IPVPN to multiple sites

  a) from the ISP's website it is showing IPVPN is related to MPLS, So do i need to configure anything from our side? or ISP will do this?initially i thought it was similar to site-to-site vpn.

Ok now for the IPVPN which is actually an MPLS VPN for Inter-Site connectivity I believe we would be using separate physical links to different ISP ( coz the existing ISP Links are showing via Modem). Well anyways for the MPLS VPN we always need a PE-CE routing protocol to run with the ISP so each site LAN routes are exchanged to the remote sites across MPLS WAN. Now since  we are here doing Double NAT ( at ASA and Router for the Internet Access that means the site router does not have visibility to LAN Subnets. We can still use this Model and run a Dynamic Routing Protocol say BGP with the ISP for the MPLS VPN Link and advertise the MPLS-VPN Link over that and receive the remote site routes dynamically. Here while doing NAT we need to ensure that the match criteria for NAT is capable to differentiate between the Internet and MPLS VPN destinations. One such way would be to PAT anything other than the Private IP range to the Public IPs and PAT everything in the Private IP range to the MPLS VPN Link.

Also for failover of wan interface do i need to create NAT and default route for each interface ???

Yes as mentioned above two default routes will be created one for each ISP and the AD value of the secondary ISP Link should be increased to use the Active:Standby Model.PAT has to be done on the router as explained above.

Hope this helps to clarify something on the traffic requirement. Do let me know for any questions.

Regards

Varma

[vipinrajrc]

Hi Varma,

Thanks for your reply...........

I have some doubts..

" Are the ISPs allocating you Public Subnets or not apart from the Peering Connectivity. What we need is to have atleast one Public IP Block assigned from any of the ISP and route the same via both ISPs and the PAT would be done via this Public IP Pool so as long as one of the ISP link is UP the PAT would still work independent of which ISP Link is UP.

We need to make sure that the Public  "

could you please explain these? yes i do have block of public IPs in each ISP connection.

" We need to make sure that the Public IP Pool assigned is routed via both ISPs to Internet and announced as less preferred via secondary ISP "

Did you mean we need to configure BGP for this?

Please suggest your opinions..

Still i have some more doubts. that i will tell you after this.

Thanks and Regards

Vipin

[Vaibhava Varma]

Hi Vipin

Please find my answers inline below:

I have some doubts..

" Are the ISPs allocating you Public Subnets or not apart from the Peering Connectivity. What we need is to have atleast one Public IP Block assigned from any of the ISP and route the same via both ISPs and the PAT would be done via this Public IP Pool so as long as one of the ISP link is UP the PAT would still work independent of which ISP Link is UP.

We need to make sure that the Public  "

could you please explain these? yes i do have block of public IPs in each ISP connection.

Since we are dual-homed to two ISPs and we would be doing NAT then for no traffic-blackholing we should be doing for NAT is to perform NAT over separate IP Block rather than the Interface Public IPs so that even if the physical connection is down with the ISP whose interface we were using for NAT ( if at all) . Doing NAT with a separate IP Pool and having that routed via both ISPs would provide us an uninterrupted traffic flow.

" We need to make sure that the Public IP Pool assigned is routed via both ISPs to Internet and announced as less preferred via secondary ISP "

Did you mean we need to configure BGP for this?

Yes If we can go fro BGP thats the best option. We need to make sure that whatever Public Block from whichever ISP we are using for NAT is routed across both ISPs backbone to Internet. With the Primary ISP Internet should see that Public Block as preferred and via Secondary ISP less preferred. Using BGP AS-Path prepending would be the best way for this.

Please suggest your opinions..

Still i have some more doubts. that i will tell you after this.

Please feel free to ask any questions and I will try my best to provide a reasonable answer :-)

Hope this helps to answer your query

Regards

Varma

[vipinrajrc]

Hi Varma,

I am still stuck with NAT.

I will tell my understandings. Please correct me if i am wrong.

1) We need to PAT to the inside LAN to the ASA's outside private IP.

this will help to communicate inside host as the same IP as the private IP address in the ASA's outside interface, right?

2) is PAT to one public IP is possible in routers ?

3) i have internal servers that need public IPs. where can i do a static NAT? in router or ASA?

Thanks & Regards

Vipin

[Vaibhava Varma]

Hi Vipin

Please find my answers inline:

1) We need to PAT to the inside LAN to the ASA's outside private IP.

this will help to communicate inside host as the same IP as the private IP address in the ASA's outside interface, right?

Yes absolutely and this will help to get rid of the reverse route requirement on the router as the ASA-Router Interface is a directly connected route on the router. What we are doing here is Double NAT. First we NAT the LAN Subnet to the ASA's external Interface Subnet IP towards Router using PAT and then we PAT the ASA's external Interface Subnet IP to Public IPs on the router using PAT again.

2) is PAT to one public IP is possible in routers ?

Yes it is possible, thats what PAT is all about to conserve the Public IPs using Port-Based differentiation.

3) i have internal servers that need public IPs. where can i do a static NAT? in router or ASA?

Now thats a tricky requirement, if you have some Internal Servers that need Static NAT to Public IPs then while doing PAT at the ASA please exclude all such servers in the ACL and let them reach the router without NAT. Put a reverse route for those servers pointing back to ASA and then do a Static NAT with Public IPs on the router. This way we would help ourselves to achieve the Static NAT for some internal Servers at the Router and Double NAT for all other Servers--Once at ASA  using PAT to private IP and then at Router using PAT to Public IP.

Hope this helps to answer your query. Do let me know for any questions.

Regards

Varma

[vipinrajrc]

Hi Varma,

Now i understand!!!........

Do we need to configure MPLS IPVPN or Will it do by ISP?

For this is it necessary that all the branches  are in same ISP..

Thanks and regards

Vipin

[Vaibhava Varma · Accepted solution]

Hi Vipin

MPLS L3 VPN is a Service provided and conifgured by ISP and also in sync with Customer by running a PE-CE routing protocol (Static,OSPF,BGPe.t.c).

Yes we need to have all sites to be served by same ISP for a MPLS VPN Service.

Hope this helps to answer your query

Regards

Varma

[vipinrajrc]

Hi Varma,

Thanks...now i understand.

Now i need to study about BGP for load balancing.

But for the time being i can manage the load balancing by two static routes with different AD, right?

Thanks

Vipin

[Vaibhava Varma]

Hi Vipin

Good Luck with your BGP studies..

Yes we can very well achieve the load-balancing (Active:Active) using two default-route with same AD pointing to different next-hops or Automatic Failover (Active:Standby) using floating-static default-route with higher AD.

All the best with your implemenation and feel free to post more questions :-)

Regards

Varma

[Kishore Chennupati]

 Yes we need to have all sites to be served by same ISP for a MPLS VPN Service.

Hi Vipin,

You can run  MPLS VPN service between differnet AS's but the same ISP would mean easy policy administration. But this is not a rule. You can run MPLS VPN's between ISP's between different AS's if the ISP's can agree upon the protocols and policies. For eg: I can have a customer site in Australia and another customer site in New Zealand. We can have a MPLS VPN between runnign between our Australian ISP and the New Zealand ISP.

Would I be right Varma? Just a thought

Regards

Kishore

Regards

Kishore

[Vaibhava Varma]

HI Kishore

You are absolutely right that its not a limitation for the MPLS VPN Service to be only under the administration of one ISP. But from the Customer Service Order point of view I would say it should be left upon the ISP to decide whether the ISP has a geographic presence everywhere or not and the ISP itself should be deciding factor to go for an Inter-AS MPLS VPN to serve its customer. To the customer it should be transparent that he/she being served by one ISP only becuase I think it will always be better for the customer to followup when some issue occurs in the services or something.

I don't think if the Customer goes upto an ISP and says I need an Inter-AS MPLS VPN and you need to peer with another ISP for same will be something which can be met by the ISP so easily. That does not sounds feasible to me personally. Its the ISP calls if he has a private NNI with other ISPs whom he can work along with to provision an Inter-AS MPLS VPN and service its customers.

Hope this clarifies my viewpoint.

Regards

Varma

[vipinrajrc]

Hi Varma/Kishore,

i have one more doubt.

I need to create a S2S VPN to this site.

As we discussed earlier, ASA's local IPs(all internal Ips. there is more than 20 subnets) is going to PAT to the outside IP of the ASA. If i implement the 2851 router in front of the ASA, VPN will terminate to that router, right?

So how can i take RDP of the servers/desktops inside the ASA.

Right now i can take RDP/remote of the machines as the VPN is terminated in the PIX(which is direclty connected to the internet).

So how can i take RDP of the servers/esktops if the vpn terminates in the router and the PAT in ASA?

Can i use a no NAT for all the internal IPs inside the ASA? Then put a route in ASA and rourter.

Will it work?

Did i miss anything? Do i need to create ACL for the outside interface of ASA for permit traffic from my office to the LAN inside the ASA? i think i need to create..

Thanks

Vipin

[Vaibhava Varma]

HI Vipin

S2S will be between the 2851 and remote side WAN Device.

The Local LAN Subnets internal need to access Internet also right ? Then we need to NAT them at the 2851 Router instead of ASA same as we did for Web-Server. Reverse route for the LAN Subnets would be needed on the 2851.

Rules will be definitely required in ASA for allowing remote sites subnets to local subnets communication for required protocols/ports/ Outbound route for the remote side subnets would have to be defined at ASA pointing to 2851 and on 2851 same has to be pointed to the S2S VPN.

On ASA the NAT ACL has to exclude the LAN Subnets from getting PAT.

Hope this helps to answer your query.

Regards

Varma

[vipinrajrc]

Hi Varma,

Thanks for your help.

I will let you know if have any further questions.