FP/ASA 2 ISPs, RAVPN on 1 and default route via the other?

[the-lebowski]

Is it possible to have RA-VPN/Secure Client configured on one outside interface while having local internet traffic route out another outside interface? Something like this?  Is it as easy as adding a route to the RA-VPN subnet pointing to the interface its configured on while having the default route point towards the other? 

[Rob Ingram]

@the-lebowski 10.10.90.0/24 is the VPN client IP address, but you actually need a route to the public IP addresses the client traffic is coming from?

Perhaps use PBR for the traffic via outside1 for internal resources accessing the internet, than have the default route via outside2 for RAVPN to establish a VPN. Example of PBR, amend to meet your scenario.

[MHM Cisco World]

No need any config'

Since anyconnect initiate conn to ISP1

FTD check conn first and always use ISP1 for anyconnect.

Other traffic initiate from inside host will use defualt route toward ISP2.

So what you want only make sure anyconnect conn to ISP1.

MHM

[the-lebowski]

So its FTD hardware but running ASA code so this still applies?  This was my original thought as well but wanted to be sure.  Also what happens with tunnel all profile, does that traffic still go out ISP1 or will it take default route configured towards ISP2?  

[MHM Cisco World]

So its FTD hardware but running ASA code so this still applies?  This was my original thought as well but wanted to be sure. It work for FTD and ASA 

Also what happens with tunnel all profile, does that traffic still go out ISP1 or will it take default route configured towards ISP2?  Add tunnel-all will make traffic go toward ISP2' but we usually use tunnel-all to direct vpn traffic to out via same ISP interface not via other ISP.

MHM

[the-lebowski]

What I was asking for tunnel-all hairpin/uturn traffic back to the internet and which interface that will take?  We have NAT statements for that specific traffic (anyconnect TA client > firewall > internet) and it points to ISP1 which AnyConnect is configured on.   There was some concern that traffic would take the default route out ISP2 and cause a NAT issue but not so sure.  

[MHM Cisco World]

If we use tunnel-all and traffic egress via one interface and hairpin via other interface the traffic will drop.

So we need to use only split tunnel not tunnel all.

MHM

[the-lebowski]

So no way to make TA work when using separate outside interfaces for AnyConnect and egress traffic?   Getting confused with the back and forth and just want to make sure TA will work when configuring AnyConnect and egress traffic on different interfaces.