Hi,    Need advice from senior senior, :).  I'm looking for solution for doing multihoming internet connection. The Situation: 1. We have internet connection to 3 ISP. 2. 2 ISP use eBGP, and 1 ISP use static route. 3. We have our own ASN and 2 /24 public IP address. 4. For static route we use /28 ISP provided address. 5. We have 3 internet faced router for connect to isp, for each ISP we provide  dedicated router 6. All(3) internet faced router connect with ibgp. 7. In eBGP routing, we publish all the 2 /24 ip to each ISP with some priority(as path). we expect x.x.x.x/24 must through/going back from isp1 and y.y.y.y/24 must through and going back from isp2. 8. And Below the router we have 2 ha load balancer (f5). 9. The f5 is the device doing NAT, the boundaries between public and private ip. 10. So far with f5 I can config which private ip going to isp1 or isp2.  11. Because f5 can do a cluster/ha I don't need doing config on both devices, except interface config. 12. If one ISP down/cable disconnected/bgp not establish, f5 automatically use another ISP base on weight. 13. And last below f5 we have firewall. I have suspicious that this f5 slowing down my internet connection or I can improve my internet with change f5 to router. But with router we have some drawback like config twice and it cannot automatically failover to another ISP if one ISP unavailable. And also I don't sure with router pbr I can't config which private ip out to what ISP. The Question : Can I change my f5 with router? Can you give me a point where can I dig some knowledge more? Thx       ... View more

Hi, It is forbidden to do NAT Exempt from Internal to DMZ ? I hear there is a compliance in banking that 2 server who needs to communicate but its forbidden to know each other ip address ? How about NAT as second layer or firewall ? What is best practice to secure enterprise network from NAT point of view ? Thx ... View more

Hi, Cisco wlc have feature to redirect captive portal auth to different external web server, what open source captive portal server ? Thx              ... View more

Hi, Theres a cisco document about building a fully routed enterprise network with ospf or eigrp out there. I have a question in internet layer based on picture below : 1. interface belong to area 0 is interface connecting dist to core/backbone, is this correct ? 2. interface belong to ospf area 200 is interface connecting dist to firewall and all firewall interface, is this correct ? 3. if theres is an edge router connect to firewall and that edge router connect to isp with bgp let say private bgp and my network publish class c ip address, i dont understand to distribute ospf to bgp ? where do i distribute, in edge router ? do my router to firewall have point-to-point public ip address ? Thx ... View more

hi, my company recently bought a smartnet CON-SU1-ASA40K9, i already register my email with the contract number so i can get additional access to download ips update signature/software/engine and asa update, but i cant download those thing ? did i do something wrong ? i already sent email to ent-dl@cisco.com but doesnt get respond. What privilege do i get by bought this smartnet CON-SU1-ASA40K9, which not cheap almost 1/4 of the firewall price. thx ... View more

Can cisco block/filter https url such a https://www.cisco.com with inspect map or AP-SSM? From Whaat i know is asa need third party like websense, to block. https url. Thx ... View more

I have asa as a gateway to internet, can i have a complete view or log traffic flow through my asa, i already try netflow but what i see is top-n traffic not all traffic. Thx ... View more