Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About andrewpratt15
08-18-2017
Stats
Member since
02-18-2014
7
Posts
0
Helpful
0
Solutions
02-19-2014
09:34 AM
I will overload all client traffic but not the traffic from the servers. The traffic from the servers will be NATd to a different IP than the interface. I will look through that document you linked, I think I am now on the right track. I will come back if I can't figure it out. Thank you very much!!
... View more
02-19-2014
09:23 AM
I just noticed the bit at the bottom of that link I sent, where it spells out the static NAT advice, would that work for my situation?
... View more
02-19-2014
09:19 AM
I see, a little clearer now. So I'm looking at this, http://docwiki.cisco.com/wiki/NAT_failover_with_DUAL_ISP_on_a_router_Configuration_Example which is essentially similar to my situation, except I can't use overload for the NAT because I don't want to use the interface IP, I want to use a different IP (the 192.168.1.11 or 172.16.0.11) Is there anyway to set this up without overload? I see in the syntax I can use a pool, but then it won't be applied based on the exit interface it will be applied globally which will interfere with the traffic while ISP1 is up. I greatly appreciate your advice.
... View more
02-19-2014
08:21 AM
Adding to my question about NAT, if I perform ISP1 NAT on the firewall and ISP2 NAT on the router, what happens if everything fails over to ISP2? What would my NAT look like? Currently (in my lab) I have it setup to NAT server 1 on the firewall, and that works fine, but what happens when ISP1 goes down? It will still be NATing it on the firewall, the only thing I could think of when you say have NAT for ISP2 on the router is to have that (already NAT'd) IP as the source, but then it would apply no matter what. Do I have to use route-map for NAT and SLA monitoring to track?
... View more
02-19-2014
07:44 AM
Thank you for the reply Jon. I am thinking I would probably just move all NAT to the router then. 1) Yes VPNs do terminate on the firewall 2) If the connection to the mail servers goes down, I'm told that the relay provider we use, has a system that monitors and can swap to our secondary IP if the first is unreachable via their pings. So incoming NAT would basically have a rule for both external IPs to head to the same internal IP. However I am not familiar with the mail relays setup, I am just told it works that way. The reason we added the router is because we needed failover (which the ASA supported) but we also needed to utilize both ISPs simultaneously (which the ASA did not support). So do you think this is even doable? Sadly, our old Sonicwall firewall did all of this in one device, with no issues, and I convinced my boss to switch to Cisco since I had prior positive experiences, and I am now left trying to figure out how to get him what he wants again
... View more
02-18-2014
02:33 PM
I have recently acquired a 2921 router to do policy based routing for my WAN links, as I was unable to do so with the ASA 5512. With the new router I plan on implementing something similar to below. I have a two servers (let's say they're both mail servers) that I want to primarily use ISP 1, and I would like the rest of my traffic to utilize ISP 2. When ISP 1 fails, I want to utilize ISP 2 for the server traffic that was destined for ISP 1. I know I can setup IP SLA monitor and policy based routing to achieve these goals, but I am unsure of how my exact setup should look. I currently have all NAT taking place on the ASA, meaning I have the (in the example) 192.168.1.11 leaving the ASA after being NAT'd. Can I keep this configuration or do I need to move NAT to the router in order for the setup to work? To to summarize what I need 2 servers using ISP 1 as primary Clients using ISP 2 as primary IP SLA Monitor to track failover of links, so that if ISP 1 goes down, the server will use ISP 2. Likewise if ISP 2 goes down, the clients will use ISP 1. Can I keep NAT on the firewall? Are there any other concerns I should be aware of? Thank you! (if I need to connect 2 links between the ASA and router, please let me know)
... View more
Labels:
02-19-2014
I will overload all client traffic but not the traffic from the servers.
The traffic from the server...
02-19-2014
I just noticed the bit at the bottom of that link I sent, where it
spells out the static NAT advice,...
02-19-2014
I see, a little clearer now. So I'm looking at
this,http://docwiki.cisco.com/wiki/NAT_failover_with_...
02-19-2014
Adding to my question about NAT, if I perform ISP1 NAT on the firewall
and ISP2 NAT on the router, w...
02-19-2014
Thank you for the reply Jon.I am thinking I would probably just move all
NAT to the router then.1) Y...
Public Statistics
| Date Registered | 02-18-2014 02:16 PM |
| Date Last Visited | 08-18-2017 04:01 AM |
| Total Messages Posted | 7 |
