Routing outside two different interfaces....

[haidar_alm]

Hello,

I'm working on configuring a 5520 ASA device.

The requirement is that I configure two outside interfaces for two seperate public internet access. Each interface will be using a different ISP.

I've made the following configuration, and i'm not sure if this will work or not and wanted to see your opinoin:

One outside interface is named (outside), and the other one is named (SWGFL_OUTSIDE)

Please note that I've cut some of the config out...

access-list DMZ_PUBLIC_ACCESS_IN extended deny ip object-group Public-LAN object-group SDHC-LAN

access-list DMZ_PUBLIC_ACCESS_IN extended permit ip any any

access-list inside_access_in extended deny ip any any

access-list OUTSIDE_PUBLIC_ACCESS_IN extended permit icmp any any traceroute

access-list OUTSIDE_PUBLIC_ACCESS_IN extended permit udp any any eq isakmp

access-list OUTSIDE_PUBLIC_ACCESS_IN extended permit icmp any Outside 255.255.255.0

access-list DMZ-SWGFL_ACCESS_IN extended deny ip object-group SWGFL-LAN object-group SDHC-LAN

global (outside) 1 interface

global (SWGFL_OUTSIDE) 2 interface

nat (DMZ) 1 192.x.x.0 255.255.255.0.

nat (SWGFL_OUTSIDE) 2 192.168.x.0 255.255.255.128

access-group OUTSIDE_PUBLIC_ACCESS_IN in interface outside

access-group inside_access_in in interface inside

access-group DMZ_PUBLIC_ACCESS_IN in interface DMZ

access-group DMZ-SWGFL_ACCESS_IN in interface SWGFL_DMZ

route outside 0.0.0.0 0.0.0.0 192.168.x.1 1
route SWGFL_OUTSIDE 0.0.0.0 0.0.0.0 192.168.x.1 1

Would this work?

As you can see 

KR

[varrao · Accepted solution]

Hi KR,

ASA cannot have multiple default routes, it can have only one single default route. So the setup that you are trying to do would not  work. Since ASA cannot do Policy based routing, if you want to do this kind of setup then you would need to do it on a router, but on ASA its not possible.

Hope that helps.

Thanks,
Varun Rao
Security Team,
Cisco TAC

[John Peterson]

Are any of the ISP going to only connect to a specific ip on the Internet or a list of ips ?

Sent from Cisco Technical Support iPhone App