I have an ASA and a load balancer (F5) that i'm trying to configure as follows and experiencing routing issues.
A load balancer with 4 ports.
Port 1 connected to ISP 1
Port 2 connected to ISP 2
Port 3 connected to ASA outside interface.
Port 4 currently not connected.
ASA default route is set to point to the IP address of Port 3 on the load balancer. This IP address is a private IP address.
I'm looking to use this same ASA for VPN. As such i want to activate port 4 on the load balancer. Port 4 will be in the address space of ISP 1. Port 4 from the Load balancer will connect to Interface 4 on the ASA. Interface 4 on the ASA has a public IP address in the space of ISP 1. Interface 4 on the ASA will thus be my VPN termination point.
When users connect to the VPN they connect to an IP address in the space of ISP 1. This traffic is then routed to ASA interface 4.
The problem occurs when users connect to the VPN. Their traffic gets dropped by the ASA as it cannot find a route back to them. The default route set on the ASA(A private IP address) points to port 3 of the LB, which is not where their traffic came from in the first place.
Unfortunately your current set up is causing asymmetric routing which the firewall will drop. This is by design. You need to either configure Public IP to the ASA's outside interface ( and reconfigure the load balancer accordingly )and terminate the VPNs there or configure the routing on the ASA so that default route is by interface 4
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :