08-24-2010 03:00 AM - edited 03-04-2019 09:32 AM
Hello, I was wondering if someone can help, I am fairly new to PIX's but have been using firewalls for a long time so please bear with me.
We are in the process of integrating a new ISP into out infrastructure, During this there will be a period of time where the both WAN links are active to allow a cross over for our external services. I would like to know how to have two active outside interfaces to allow us to migrate our customers from one service to another without taking the Old Link down.
Thanks
08-24-2010 03:14 AM
I have found that the ASA, sw 8.2.3 is unable to use two default routes (with NAT), as opposed to a router that is able to.
Perhaps by manipulating the nat statements carefully, but certainly is not a strightforward process.
08-24-2010 03:17 AM
I am happy to keep the defualt route on the old link until it is turned off, then change the defualt route. I just want to allow people in via the new link so we can get customers to test the service before we cease the old lines
08-24-2010 03:21 AM
Yes, once you switch the default route and everything will be switched, not a problem.
08-24-2010 03:22 AM
Does this mean I can have to interfaces named outside1 and outside2 set to a security level of 0
08-24-2010 03:25 AM
Yes.
Please remember to rate useful posts clicking on the stars below.
08-24-2010 05:12 AM
Hello,
If you have two ISP connections and you would like to use both of them until
they are active, you can certainly do that. Normally, the firewall allows
only one default route and the other one need to be used as a backup route.
However, through a workaround, you could send a specific traffic type
through the other link. Also, if you just want to test, you can add specific
route statements on the pix sending traffic destined to specific
hosts/network through the second link. Check the following examples:
If you would like to send traffic destined to specific host/network via second link:
--------------------------------------------------------
global (outside2) 1 interface
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0
route outside2 64.1.1.0 255.255.255.0
If you would like to use the second ISP as a backup link:
--------------------------------------------------------
global (outside2) 1 interface
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0
sla monitor 123
type echo protocol ipIcmpEcho
sla monitor schedule 123 life forever start-time now
track 1 rtr 123 reachability
If you would like to send specific traffic type via second link:
-----------------------------------------------------------
route outside 0.0.0.0 0.0.0.0
static (outside2,inside) tcp 0.0.0.0 80 0.0.0.0 80 netmask 0.0.0.0
global (outside2) 1 interface
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
Hope this helps.
Regards,
NT
08-24-2010 10:21 PM
08-24-2010 08:34 AM
You can definitely to do this in 8.0 (btw, the latest code I can find for the PIX is 8.0(4)).
Here is a link which explain how to do it
Regards,
jerry
08-24-2010 12:57 PM
From the document linked above:
Note: Load balancing does not occur in this example.
That is the limitation I was referring to before. Primary/secondary links is easy, load balancing, not sure. A router does that without any problem.
08-24-2010 01:19 PM
I don't see any where in the thread about a requirement for load sharing. Also, I am 100% with you on load sharing in the PIX/ASA.
Regards,
jerry
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: