VPN traffic issues.

incognito_54 · ‎01-13-2009

I have an ASA and a load balancer (F5) that i'm trying to configure as follows and experiencing routing issues.

A load balancer with 4 ports.

Port 1 connected to ISP 1

Port 2 connected to ISP 2

Port 3 connected to ASA outside interface.

Port 4 currently not connected.

ASA default route is set to point to the IP address of Port 3 on the load balancer. This IP address is a private IP address.

I'm looking to use this same ASA for VPN. As such i want to activate port 4 on the load balancer. Port 4 will be in the address space of ISP 1. Port 4 from the Load balancer will connect to Interface 4 on the ASA. Interface 4 on the ASA has a public IP address in the space of ISP 1. Interface 4 on the ASA will thus be my VPN termination point.

When users connect to the VPN they connect to an IP address in the space of ISP 1. This traffic is then routed to ASA interface 4.

The problem occurs when users connect to the VPN. Their traffic gets dropped by the ASA as it cannot find a route back to them. The default route set on the ASA(A private IP address) points to port 3 of the LB, which is not where their traffic came from in the first place.

I hope this lengthy expl. makes sense.

Please help. Pulling hair out.

Thanks

.a

Fernando_Meza · ‎01-13-2009

Hi,

Unfortunately your current set up is causing asymmetric routing which the firewall will drop. This is by design. You need to either configure Public IP to the ASA's outside interface ( and reconfigure the load balancer accordingly )and terminate the VPNs there or configure the routing on the ASA so that default route is by interface 4

I hope it helps .. please rate helpful posts

incognito_54 · ‎01-14-2009

Thank you much for your response. I've tried terminating IPSEC connections at the load balancer but this breaks the VPN connection as the ASA is the intended termination point.

Changing the IP address of the outside interface of the ASA would force traffic to go outbound via only one interface on the load balancer negating the use of the load balancer.

Thanks for your time.

Sky.