Hi!
i have been hired by a company that wants to host its own web services like financial research in its own data center and asked to come up with a solution that will be available 24/7.
however i came up with a solution "Draft diagram attached", but i have a few questions regarding the configuration of the Cisco ASA 5550.
1- if BGP is not possible to be configured at this time. can i have two leased line internet connections comming to both of the outside routers and to have one of the lines configured as a backup interface "on the ASA device"?
2- can i have each one of the DNS servers on a separate subnet? assuming that the first ISP range is 1.1.1.0 and the second is 2.1.1.0.
3- is the below configuration example for the Active ASA right " ACLs, Failover, backup ISP config & Nating"?
ASA1# sh run
: Saved
:
PIX Version 7.2(3)
!
hostname ASA1
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0 standby 192.168.0.2
!
interface Ethernet1
nameif dmz
security-level 50
ip address 172.16.0.1 255.255.255.0 standby 172.16.0.2
!
interface Ethernet2
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.0 standby 1.1.1.2
!
interface Ethernet3
no nameif
no security-level
no ip address
!
interface Ethernet4
nameif backup
security-level 0
ip address 2.1.1.1 255.255.255.0 standby 2.1.1.2
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list outside_int extended permit tcp any host 1.1.1.3 eq domain
access-list outside_int extended permit udp any host 1.1.1.3 eq domain
access-list outside_int extended permit tcp any host 1.1.1.4 eq www
access-list outside_int extended permit tcp any host 1.1.1.4 eq https
access-list backup_int extended permit tcp any host 2.1.1.3 eq domain
access-list backup_int extended permit udp any host 2.1.1.3 eq domain
access-list outside_int extended permit icmp any any
access-list inside_int extended permit ip any any
access-list dmz_int extended permit tcp host 172.16.0.50 any eq domain
access-list dmz_int extended permit tcp host 172.16.0.51 any eq domain
access-list dmz_int extended permit tcp host 172.16.0.100 any eq www
access-list dmz_int extended permit tcp host 172.16.0.100 any eq https
access-list dmz_int extended permit ip any 192.168.0.0 255.255.255.0
pager lines 24
mtu inside 1500
mtu dmz 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
global (backup) 1 interface
nat (inside) 1 192.168.0.0 255.255.255.0
static (inside,dmz) 192.168.0.0 192.168.0.0 netmask 255.255.255.0
static (dmz,outside) 1.1.1.3 172.16.0.50 netmask 255.255.255.255
static (dmz,backup) 2.1.1.3 172.16.0.51 netmask 255.255.255.255
static (dmz,outside) 1.1.1.4 172.16.0.100 netmask 255.255.255.255
static (dmz,backup) 2.1.1.4 172.16.0.100 netmask 255.255.255.255
access-group inside_int in interface inside
access-group dmz_int in interface dmz
access-group outside_int in interface outside
route outside 0.0.0.0 0.0.0.0 1.1.1.10 1 track 1
route backup 0.0.0.0 0.0.0.0 2.1.1.10 254
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
sla monitor 123
type echo protocol ipIcmpEcho 1.0.0.2 interface outside
num-packets 3
frequency 10
sla monitor schedule 123 life forever start-time now
track 1 rtr 123 reachability
telnet timeout 5
ssh timeout 5
console timeout 0
Thanks in advance for your help,,,