06-22-2012 06:16 AM - edited 03-11-2019 04:22 PM
Hello,
I'm working on configuring a 5520 ASA device.
The requirement is that I configure two outside interfaces for two seperate public internet access. Each interface will be using a different ISP.
I've made the following configuration, and i'm not sure if this will work or not and wanted to see your opinoin:
One outside interface is named (outside), and the other one is named (SWGFL_OUTSIDE)
Please note that I've cut some of the config out...
access-list DMZ_PUBLIC_ACCESS_IN extended deny ip object-group Public-LAN object-group SDHC-LAN
access-list DMZ_PUBLIC_ACCESS_IN extended permit ip any any
access-list inside_access_in extended deny ip any any
access-list OUTSIDE_PUBLIC_ACCESS_IN extended permit icmp any any traceroute
access-list OUTSIDE_PUBLIC_ACCESS_IN extended permit udp any any eq isakmp
access-list OUTSIDE_PUBLIC_ACCESS_IN extended permit icmp any Outside 255.255.255.0
access-list DMZ-SWGFL_ACCESS_IN extended deny ip object-group SWGFL-LAN object-group SDHC-LAN
global (outside) 1 interface
global (SWGFL_OUTSIDE) 2 interface
nat (DMZ) 1 192.x.x.0 255.255.255.0.
nat (SWGFL_OUTSIDE) 2 192.168.x.0 255.255.255.128
access-group OUTSIDE_PUBLIC_ACCESS_IN in interface outside
access-group inside_access_in in interface inside
access-group DMZ_PUBLIC_ACCESS_IN in interface DMZ
access-group DMZ-SWGFL_ACCESS_IN in interface SWGFL_DMZ
route outside 0.0.0.0 0.0.0.0 192.168.x.1 1
route SWGFL_OUTSIDE 0.0.0.0 0.0.0.0 192.168.x.1 1
Would this work?
As you can see
KR
Solved! Go to Solution.
06-22-2012 06:38 AM
Hi KR,
ASA cannot have multiple default routes, it can have only one single default route. So the setup that you are trying to do would not work. Since ASA cannot do Policy based routing, if you want to do this kind of setup then you would need to do it on a router, but on ASA its not possible.
Hope that helps.
Thanks,
Varun Rao
Security Team,
Cisco TAC
06-22-2012 06:38 AM
Hi KR,
ASA cannot have multiple default routes, it can have only one single default route. So the setup that you are trying to do would not work. Since ASA cannot do Policy based routing, if you want to do this kind of setup then you would need to do it on a router, but on ASA its not possible.
Hope that helps.
Thanks,
Varun Rao
Security Team,
Cisco TAC
06-22-2012 08:36 AM
Are any of the ISP going to only connect to a specific ip on the Internet or a list of ips ?
Sent from Cisco Technical Support iPhone App
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: