PBR on Cisco ASA

[Pounii]

Hi everyone,

I'm a newbie here so probably I'm missing something.

I got from my work an old ASA 5515-x, to use for personal purpose at home and (why not?) to start learning something new. I have 2 ISP, one wired (7 Mb in down, 0,3 Mb in up) and the other is a 4g connection. My target here is to use the 4g connection like the default one, and use the wired just for game connections. The best way to handle this is to use a PBR and ACL to change route just when the connection is in some ports ranges. I was able to do that, the strange fact is that when I simulate to lost the game connection (both case, router unreachable and router up, but line down), ASA doesn't swap the traffic flow to the default route, or better, it do it just if I close the game and start it again, otherwise all the traffic are dropped. I don't think this is normal ( in a work enviorment will be unacceptable for sure). In order to track the reachability of the route map I used the command below:

sla monitor 1
type echo protocol ipIcmpEcho 192.168.1.1 interface outside2 <--- the connection game 
sla monitor schedule 1 life forever start-time now

I checked it and is working fine, then I linked to a track used in the route-map

track 100 rtr 1 reachability

route-map Games permit 10
match ip address Games
set ip next-hop verify-availability 192.168.1.1 1 track 100

When I simulate the connection drop, I can see with

 show route-map

that it recognise the route is down. I set up also the default route

route outside1 0.0.0.0 0.0.0.0 192.168.8.1 1 
 

Attached the config file

[MHM Cisco World]

I can not open zip file now, but are you apply the

route-map policy

under the interface ??

[Pounii]

Hi, thank you for you reply. Sure, infact it's working, it's using the wired just for the game. The issue is that it's not swap to the default route when the wired network goes down... I have to colse the game and repoen it to let it take the default route ( the 4g connection). 

[MHM Cisco World · Accepted solution]

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113592-udp-traffic-fails-00.html

please check the above link, you need to config floating to make UDP traffic shift from one link to other 

[Pounii]

Hi,

thank you for your reply. You got the first point! Unfortunately the minimun timeout is 30 secs but I can accept it. Now another question: why the application is not coming back to the primary route when it came up again? 

[MHM Cisco World]

I lab this and using

floating-time 0:0:0 not 0:30:0 

and I success go back to

 primary (route-map)

after failed. 

but I need two-three hr to test something else I will update you. 

[Pounii]

If I use 

floating-time 0:0:0

it will not swap when the link goes down ( like in the first post)

[Pounii]

another fact I noted right now: I cannot track a connection which is not the actual primary route. If I use:

type echo protocol ipIcmpEcho 8.8.8.8 interface outside2

the result is in a not reached hop, because the actual primary route ( for the rest if internal network, not for game, that is routed by route-map) is 192.168.1.1.

[MHM Cisco World]

I will lab it tonight and update you 

[MHM Cisco World]

I need two-three hr to finish the lab 
but why you change the echo destination ?

type echo protocol ipIcmpEcho 192.168.1.1 interface outside2 

type echo protocol ipIcmpEcho 8.8.8.8 interface outside2

if you want to use 8.8.8.8 then you need static route 

route outside2 8.8.8.8 255.255.255.255 192.168.1.1

[Pounii]

Let me explain better my situation and topology:

-1 ISP: 4g connection through a router with SIM; I want to use this one for everithing exept game (latency is not good)
-2 ISP: old wired connection (7Mb with Telecom); I want to use this for game (good latency but just 0,3 Mb in upload, if I use this for send a photo through whatsapp for example, everithing lag in game)

First problem: the wired network goes down like 5-10 times a day, so when I'm in game I want at least use the 4g connection. So I think the best scenario is: like 1st link use the 4g connection for everithing (done), then with a PBR swap to the 2nd just for connection to certain UDP port range (done), but i want to track it, because is not stable ( I think i have to track an external server like 8.8.8.8), but if I add a statick route, it will not tracked because will be not the primary. Even if I simulate another issue like router for ISP2 goes down, whne he came back up it will not return to the route managed by PBR ( i was able to swap when goes down thankfull to your first reply here)

Sorry for my english and thank you again for your support!

[MHM Cisco World]

I share you with my lab, the R3 generate UDP-ECHO and R1 is the next-hop with route-map 
then I shutdown interface in R1 and you see the traffic shift to R2 
then no shut interface in R1 and traffic return to forward to R1 

the issue I think is as I mention before is you for track 8.8.8.8 you need static route for 8.8.8.8 toward the next-hop of route-map.

[Pounii]

If i track 8.8.8.8, I cannot neither swap when router goes down, because I need a static route as you told, but even if I put the static route, track doesnt work because that static route is not the primary. I think is not possible to track an address with a route that is not primary. 

By the way I had already try to track 192.168.1.1 (just for test, this will not save me from the down time), and yes, swap when goes down and it didn't swap again when came up again. I think the difference from me and your lab is that you route-map  to r1 without a static route to the r2 for rest of the traffic

[MHM Cisco World]

no I also

config static default route toward the R2

 
but regard the track are you sure that you use the correct interface in sla monitor ??