Policy-based routing problems

[smailmilak83]

Please take look at this topic. The ASA firewall is making me a headache.

WAN, Routing and Switching: Policy-based routing.

[smailmilak83]

Well, I have not designed this network.

I think the central router is terminating VPN because of OSPF routing (tunnel interfaces with GRE)

The central router is not behind the ASA for internal. The ASA has its own internal network (HQ) and the others are all remote sited that have to go through the ASA because of authenticaion (not all users are allowed to surf on the internet)

OSPF is already encapsulated in the tunnel on remtoe site and central routers

ASA is already a gateway for the internal network (not for remote sites) ASA can't send them a defaulte route because the is the central router in between

[andrew.prince]

OK - a simple solution would be to:-

1) Terminate the VPN on the ASA

2) Have the tunnel desintation on the central router for the remote point to the ASA

3) In the ASA configure the crypto map for the tunnel srouce & desinations of the tunnels.

4) Directly connect the ASA to the internet circuit

5) Have the central router have only 1 connection to the ASA

6) Distribute a default route in OSPF - remote users would dynamically route over the tunnel thru the IPSEC to the central router, the central router woudl route the internet traffic directly to the ASA where they can be authenticated.

HTH>

[smailmilak83]

Well I know that when the ASA would terminate the VPNs my problem would be solved. But I don't know if my client would like that, because that is a lot of work.

And I have one question. Does the ASA have tunnel interfaces like a router? So that I can use GRE?

[andrew.prince]

No the ASA does not support GRE tunnels.

At the end of the day you should explain to your customer that the current topology/configuration is sub-optimal and can be improved 100%

HTH>

[smailmilak83]

So your advice is that the ASA terminates the VPNs and that the router is there only for the internet?

There is a problem too, a Frame-Relay router is connected on the router for other remote sites! I think that I could use a subinterface on the ASA for that!

[andrew.prince]

If you just do that - what are you going to use as a layer 3 routing device on the inside?

Possibly - or just shift all the internal routing to the device that has the frame-relay - this is the central internal router.

then the other router can just be used for internet routing, and the ASA can be the secuure device that seperates the internal to internet.

[smailmilak83]

Well thank you. I will consult myself with my workmate.

[andrew.prince]

np - glad to help