Using PBR to change firewall

[impi]

Hi,

Our ASA is managing many vlan and is the gateway of  all our machines, a simple setup.

We need to change the ASA.

Our idea is to use our SX350X switch stack to route traffic to either the old firewall, either the new one.

For that we only need to change gateway on our machines to be the stack.

But we also need the stack to route packets to firewall using the vlan gateway where it received the packets, if we only use the stack default gateway to router, we'll face some asymetric routing that asa do not like at all (please see diagram bellow where i'm trying to explain what i mean).

Then we need to do PBR on stack telling "if you receive a packet on interface vlan X, forward it the the ASA vlan x interface"

This is a simple PBR, not difficult to do, we tried and it works well except : the stack only supports 12 route-map statements !

It means that with 2 or 3 statement per PBR (some trafic to new firewall, some trafic to old one) we will only manage 4-5 vlan not more...

I really do not know what to do.

Any clue will be appreciated.

[paul driver]

Hello

Why do you require multiple route-maps as a single route-map can support multiple stanzas, matching on differing criteria. 

[impi]

Hi Paul and thanks for you quick reply.

In fact we need one PBR per Vlan, then one route-map per vlan and we have  10+ vlan

The 12 limit is not for each vlan but is global, that is our issue

If it would be 12 route-map per PBR that would be great

[Georg Pauwen]

Hello,

--> the stack only supports 12 route-map statements

I have been looking around, but could not find any comprehensive explanation for that limit. What happens if you add a 13th statement, do you get a warning/error message ? And what do you actually configure ? Can you post your route maps ?

Either way, the SX switches are what the name implies, they are geared towards small businesses.

[impi]

Hi Georg, thanks for your reply,

we search also into doc and were unable to find that limit, but when configuring we have :

And i agree about "small business" but 12 is really a little limit !

[Jon Marshall]

Not following why you cannot just use one route map as suggested by Paul. 

So one route map but multiple match statements or sequence numbers as they seem to be referenced here and then apply the same route map to all the interfaces. 

Jon

[impi]

Hi Jon,

Yes using the same route-map applied on all vlan could be done, but the limit is not on the number of route-map but number of sequences/sections.

Here is what we did to try it, same issue :

Thanks for you advices.

[Jon Marshall]

Okay so it looks like whether using different route maps or just one with different sections it is the same limit. 

I guess PBR is seen more as larger company type thing. 

Jon

[impi]

I guess, yes ...

[Georg Pauwen · Accepted solution]

Hello,

I checked the admin guide and found the below:

To view hardware resource utilization, click Status and Statistics > Hardware Resource
Utilization.

IPv4 Policy Based Routing
- In Use—Number of router TCAM entries used for IPv4 Policy-based routing.
- Maximum—Maximum number of available router TCAM entries that can be used
for IPv4 Policy-based routing.

It looks like you can increase that value:

Click Administration > Hardware Resources.
The following fields are displayed:
• Maximum IPv4 Policy Based Routes
- Use Default—Use default values.
- User Defined—Enter a value

Page 90 of the admin guide linked below has that section...

https://s.eet.eu/icmedia/mmo_44563987_1549009906_9097_1374.pdf

[impi]

Many thanks for that, in fact we looked for "12" into the admin guide and did not found anything, your search is better

We saw that max value is 32, not sure this will be enought, but we'll go and see.

By the way, many many thanks

Have a nice day