Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

ASA routing configuration

Hi guys,

Could anyone please help me out with the configuration to meet the following requirement?

I have one MPLS link which is terminating on the MPLS router and from there I am connecting my ASA Firewall. My inside Network is I have also another internet leased line for VPN connectivity (Client Site) for the same internal users who are on and it will be worked as back-up in case of MPLS link fails. So, my ASA outside interface is connected to this public network which is originally terminated on another router. I have also a DMZ zone where specific servers are located and which are in network. That means, all of the four interfaces in my ASA firewall are configured in the following manner.

interface inside ---------- Connecting to LAN switch where users will be terminating

ip address

interface outside ---------- Connecting to Public Network facing internet router

ip address 121.164.130/24

interface dmz ---------- Connecting to Server farm

ip address

interface mpls ---------- Connecting to MPLS router interface

ip address /24

My question is, how can i configure the routing on ASA, MPLS router and internet router without enabling the NATTing on ASA? By default users must pass through MPLS cloud and the traffic has to be passed on through VPN if the MPLS link fails.

Your help in this regard is highly appriciated. Thanks

New Member

Re: ASA routing configuration

Could you explain what you do not want to NAT? Obviously to get to the internet you have to NAT somewhere. I am assuming you mean from MPLS side going to dmz side but I am not sure. Please elaborate.

Re: ASA routing configuration

Re: ASA routing configuration

If you don't want to NAT on the firewall, you can always perform NAT on the internet router.

Assuming the MPLS network does not require NAT, else you can also do a seperate NAT on the MPLS router.