Solved

Multiple ISP with out BGP and Cisco ASA 5510

Posted on 2007-04-05
2
2,974 Views
Last Modified: 2012-06-27
Hey everyone, my question involves using multiple ISP's without BGP

Here's what I have

ISP connection 1 (one T1) Call them 208.x.x.1 Cisco 2800 1 - inside interface
ISP Connection 2 (2 T1's - Multilink-FrameRelay) 76.x.x.126 Cisco 2800 2 -  Inside Interface

Cisco ASA 5510

12 Internal Subnets - 192.168.1.x - 182,168.12.x

The issue:
ISP connection 1 has been in place for a while now and it is 100% completely saturated
Public IP's are routing to the internal subnets for smtp, http and specific TCP traffic

ISP Connection 2 is a new installation from a different provider

I would like to set this up so that the ASA has one default GW and the external router(s) route the traffic based on where it came from, I.E. if an external smtp request came in on the 208 it goes back out the 208, if it came from inside my network it goes out ISP connection 2 with the exception of the publicly known addresses such as mail hosts, web hosts, etc

Now, I might be completely wrong it even thinking I can do this, but does anyone have any suggestions, example configs, or advice on this one?
0
Comment
Question by:johnstrait
2 Comments
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
ID: 18863859
Policy Based Routing with SLA monitoring on the 2800 router, combined with static nat and multiple nat globals on the ASA..

Check through these references to get an understanding and then we can come up with something that will work for you
http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00801d1e95.html
http://www.cisco.com/en/US/products/sw/iosswrel/ps5413/products_feature_guide09186a00801d862d.html
http://www.cisco.com/en/US/tech/tk364/technologies_configuration_example09186a0080211f5c.shtml
http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_configuration_guide_chapter09186a00800c60d2.html

Basically, the static nat and globals on the PIX give the 2800 a way to identify which traffic is which that can be established with access-list match, then forwarded to the appropriate next hop based on source IP. The SLA makes sure that next hop route is available. You'll also have to nat again at the 2800 interface since you are using a different ISP.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

929 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now