Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Attention: The Community will be in read-only mode on 12/14/2017 from 12:00 am pacific to 11:30 am.

During this time you will only be able to see content. Other interactions such as posting, replying to questions, or marking content as helpful will be disabled for few hours.

We apologize for the inconvenience while we perform important updates to the Community.

New Member

Asa route to different interface


I currently have a very simple setup.  ASA 5520 advertizing a default route to a 4507 switch and one internet connection for all devices.  The asa does the firewalling and NAT.

What I want to do is add a second internet connection to the asa and route, not NAT some of the users to that interface.  This second connection will be a layer 2 network to our isp which is hosting a virtual firewall for us.  So we want all of our internal ip's to hit the private side of this virtual firewall.

That said i want to keep our existing internet connection and all of the current NAT setup on the ASA.

What would be the best way to accomplish this, as I see that the ASA does not support PBR.




Asa route to different interface

Hello, Dan.

Not clear what is desired configuration for this second link and do you need any Internet access failover between interfaces, but:

- you could create additional context on ASA and configure it for second link;

- in this case you will loose dinamic routing (not compatible with contexts);

- you won't be able to run one context in routing mode and another in transparent (if you thought about it);

- PBR should be done before traffic reaches ASA (on switch/router).

Do you have any diagram describing current configuration (almost clear) and configuration for second link (including IP-addresses, NAT and routing if present).

CreatePlease to create content