NBAR + Policy Routing?

Here's the scenario:

A site in <faraway country> is connected to our headquarters via frame relay, and is supposed to use our Internet access due to the security requirements of having a full-blown DMZ, content blocking system, etc.  These standards are non-negotiable and would cost far too much to deploy at this remote location.  However, they have a few business-related sites (banks, mainly) that are located in the same country that they need to access regularly.  Since Internet traffic is currently going across the ocean several times, it's causing their sessions to time out, which is obviously not good.
 
So, given a (NAT-ed) link to a local ISP (on an interface running IOS firewall and generally locked down as much as possible, it seems that I have two options:

1. Figure out all the IPs/subnets involved with the bank sites and statically route them out the local ISP port.
2. Use NBAR to identify the relevant traffic and policy route it out the local ISP port.

Option 1 is obviously simpler in a way, but seems like it could end up being a hassle and possibly be hard to maintain since the banks are under no obligation to keep their IPs static.  So my question is, how feasible would Option 2 be?  I've worked with policy routing before, but not for this kind of problem, and I've never used NBAR at all.  Besides the "can this work" question, I'm wondering how badly this is going to kill a low-to-mid-range router to do the extra work involved.
LVL 3
MaxQAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

chicagoanCommented:
I think option 1 is reasonable, large institutions rarely change netblocks, though this doesn't protect you alone, there's no guarantee they don't have problems, but combined with PAT, sensible filters (IOS firewall features?) and syslog inspection, ought to be adequate and defensible in terms of due dilligence.

while NBAR is supported on 1700's and up last i looked, it seems like overkill here and I believe will be a lot more labor if you don't need traffic shaping, etc. whether it would be a drag on resources depends on the policies and traffic. On a 3600 and a T1 you'd probably be OK

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking

From novice to tech pro — start learning today.