ASA routing configuration

Unanswered Question
Jun 11th, 2008
User Badges:

Hi guys,


Could anyone please help me out with the configuration to meet the following requirement?


I have one MPLS link which is terminating on the MPLS router and from there I am connecting my ASA Firewall. My inside Network is 192.168.12.0/24. I have also another internet leased line for VPN connectivity (Client Site) for the same internal users who are on 192.168.12.0/24 and it will be worked as back-up in case of MPLS link fails. So, my ASA outside interface is connected to this public network which is originally terminated on another router. I have also a DMZ zone where specific servers are located and which are in 172.16.0.0/16 network. That means, all of the four interfaces in my ASA firewall are configured in the following manner.


interface inside ---------- Connecting to LAN switch where users will be terminating

ip address 192.168.12.0/24


interface outside ---------- Connecting to Public Network facing internet router

ip address 121.164.130/24


interface dmz ---------- Connecting to Server farm

ip address 172.16.0.0/16


interface mpls ---------- Connecting to MPLS router interface

ip address 10.10.10.1 /24



My question is, how can i configure the routing on ASA, MPLS router and internet router without enabling the NATTing on ASA? By default users must pass through MPLS cloud and the traffic has to be passed on through VPN if the MPLS link fails.


Your help in this regard is highly appriciated. Thanks

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
froggy3132000 Thu, 06/12/2008 - 07:01
User Badges:
  • Bronze, 100 points or more

Could you explain what you do not want to NAT? Obviously to get to the internet you have to NAT somewhere. I am assuming you mean from MPLS side going to dmz side but I am not sure. Please elaborate.

Farrukh Haroon Thu, 06/12/2008 - 07:13
User Badges:
  • Red, 2250 points or more

If you don't want to NAT on the firewall, you can always perform NAT on the internet router.

Assuming the MPLS network does not require NAT, else you can also do a seperate NAT on the MPLS router.


Regards


Farrukh

Actions

This Discussion