The problem that I see with this plan is that the ASA firewall cannot do policy based routing that would be required to send DMZ server traffic out the T1 leased line and have all other traffic go out the DSL load-balancer.
The ASA can have multiple default routes but it will try to load-balance between them which will break communications in your case because each link has a different public IP address.
Else the ASA can be configured for failover from one to the other, which is not what you desire.
Main Topics
Browse All Topics
by: QuoriPosted on 2008-08-17 at 15:34:53ID: 22248474
Okay, so looks like you'll have two external links, a DMZ and an internal network.
Cisco ASA's work on security metric from 100 to 0. The default rule of the ASA is that all traffic can flow freely from a higher metric to a lower metric but not vice versa.
So for this config you'd have two ports with an 'external' configuration and metric of 0.
One DMZ port with a metric of 50.
Then your LAN port with a metric of 100.
You would need to add ACL rules to permit any traffic required to traverse from the DMZ to the internal network, also from external to the DMZ.
Further more, you would need to setup NAT on the ASA.
If you provide some details of your IP addressing scheme, etc I am sure myself or a fellow expert will provide you a configuration.