ASA complex scenario

Unanswered Question
Jul 22nd, 2009
User Badges:

Dear all,


I have following devices for my communication rack,


- one Cisco ASA 5510 security plus

- one Cisco 2811 router

- one Cisco 3560G (layer 3) switch

- 1 linksys 24 port switch


my scenario


Internet connection (1) is connected with Cisco Router port fa0/1 and live Ip is configured


fa0/0 is connected with ASA having Ip address 192.168.74.1


ASA has three interfaces configured,

Inside

Outside

DMZ


Servers are attached with DMZ

Cisco 3560G is connected with Inside

Cisco Router is attached with outside


security level 50 for DMZ

100 for Inside

0 for outside


currently, site-to-site vpn and remote access ipsec VPN is configured on CISCO ROUTER,


Vlans are configured on cisco switch,


NOW

---------------------

I want to add another Internet connection to my ASA 4th port

---------------------


nat-control is not enabled on ASA,


I cannot enable nat-control, otherwise, my internal network mapped into one ip and don't appear on my monitoring server,


please advise, how can I configure my 4th port on the ASA for internet access only to inside network, DMZ will use primary internet connection via router, because remote users will connect via cisco vpn client,


if I enable NAT in ASA, my inside network dont connects with DMZ,


Please help

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Roman Rodichev Wed, 07/22/2009 - 05:37
User Badges:
  • Gold, 750 points or more

I don't know if this will be possible. Simple routing determines which way the traffic flows to the Internet from Inside and DMZ, they'll always use the same 0.0.0.0 route. Policy Based Routing (routing based on source) doesn't exist in ASA. It is possible to setup a backup Internet connection and use IP SLA to monitor the primary link, but that's not what you are trying to do. Did I understand you correctly, you want Inside hosts to use primary Internet connection and DMZ hosts to use secondary Internet connection? One solution would be to do routing on the next hop after the firewall. Connect second Internet connection to your router (or you could have two routers in HSRP), and then use policy-based routing to route 0.0.0.0 to a different Internet connection depending on your source IP address. You can then NAT inside addresses to one PUB IP and NAT DMZ addresses to another PUB IP on ASA.


Regards,

Roman


junshah22 Wed, 07/22/2009 - 08:50
User Badges:

I discussed it with an expert, he said, its not possible, because I need to run BGP,


he said, you can load balance for general internet use,, but when VPN will involve, then I will need to run BGP,,


what do you say??,


as i said in my earlier post that I want to use only one connection for VPN and the other one for general internet surfing,,


vlans users will use general internet,, while Servers in the DMZ will use other internet connection (having vpn)


Please advise,,

Actions

This Discussion