Multiple gateways for different Traffic on ASA 5510 firewall

itatcapital · ‎09-27-2006

Hello,

My network atthe moment is set up as:

WAN, with three sites

Site 1

Site 2

Site 3

Site 1 is behind a non-Cisco firewall, which is connected to the internet via a Frame Relay link (using a Cisco 1721 router). We host a number of servers on the Internal network and DMZ's.

All sites connect to the WAN using Cisco routers or switches.

All internet traffic (IN and OUT) for all sites goes via the non-Cisco firewall.

I am interested in the ASA 5510 with six interfaces.

Using the ASA 5510 is it possible to set up two (2) internet connections, one via the Frame Relay and a second internet connection via an ADSL connection?

Then, is it possible to direct the outward-bound traffic via specific gateways based upon either:

(a) the type of traffic, say HTTP from users behind the firewall; or

(b) the IP addresses of the host (i.e. users' PC versus the servers)

Any assistance is welcome.

Kind regards,

IT@C

mmorris11 · ‎09-28-2006

yes you can do this with policy routing on the internet router in front of the firewall assuming that you are connecting both ISPs to that router. Also, remember that you can do vlans on the ASA. This may cut down on the # of interfaces that you use in your config.

http://www.cisco.com/en/US/customer/products/ps6120/products_configuration_guide_chapter09186a0080636f89.html

HTH, pls rate!

itatcapital · ‎10-02-2006

Hi,

thanks for your prompt reply and sorry about my late reply.

The VLAN idea may be a good one, however, I think that may complicate things more than I wish at the moment.

unfortunately, we will not be using the same upstream router for the two ISP's rather will be using an ADSL router/modem for the second link, so was hoping to do the routing of HTTP traffic within the ASA firewall.

BTW, I was unable to view the document you reference as I need a username/password.

thanks,

I@C

konigl · ‎10-31-2006

This may be a little late as well. But if you delete the text string "customer/" from the link you'll be able to read the information Mike was pointing you to.