Is this possible?

Unanswered Question
Apr 28th, 2009
User Badges:

Here is the scenario.

ASA ( 1 link connects to ISP1)

( 1 link is

PIX ( 1 Link to sepearate ISP2)

( 1 Link is

Router ( link 1

6509 Switch (connects all ports)

There are 1 to 1 translations on the PIX and ASA's for public to private mappings. Lets say ASA takes ip add and translates it to The PIX translates to there will be 2 public DNS A records. As the cutover starts. So will need to be available from both ISP's at the same time.

The problem: So a packet will come in, will get translated, will goto (from the pix or asa). From there will get the packet and will send the traffic to its default gateway (the router The router has a defualt route to the PIX. So traffic coming in from the PIX will go back out the pix. Traffic coming in the ASA will go back out the PIX. Thus killing the connection. So how can i solve this with the devices at hand. What i came up with was this:

1.) Set the PREC value to 5 coming INTO the switch from ASA

2.) Reflexive ACL matching PREC 5 on port going to server OUTBOUND

3.) Set PREC 5 coming IN from the switch from server ( using

reflexive acl to match traffic going back out

4.) Policy route based on PREC 5 on the router.

The problem is the ACL in step 2 cannot be applied on an outbound on a switchport. The opttion doesn't exsist. So i thought of using a VACL, but there are only action permit or action forward so i am not sure if the reflexive ACL will work for that.

Any Ideas? I hope i explained it well enough.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)


This Discussion