ASA5510 configuration question.

Hi all,

Please help me to understand the abilities of the ASA5510.

I have a client who wishes to do the following with an ASA5510.
(and tells me it has already been done but was wiped out without backup)

Two static PPPOE DSL's in bridge mode w8 ext/ip's each
Single LAN subnet

DSL 1
ip1-1 http.domain1.com
ip2-1 http.domain2.com
ip3-1 https.domain1.com
ip4-1 ftp.domain1.com
ip5-1 exchange.domain1.com
ip6-1 site-site vpn (to a single off-site office)
ip7-1 client-access vpn (for 6 roaming users)

W/Failover
DSL 2
ip1-2 http.domain1.com
ip2-2 http.domain2.com
ip3-2 https.domain1.com
ip4-2 ftp.domain1.com
ip5-2 exchange.domain1.com
ip6-2 site-site vpn (to a single off-site office)
ip7-2 client-access vpn (for 6 roaming users)

ASA is currently running asa8.4(1)  w/asdm6.4(1)

Is this possible or for that matter even wise to do with a single ASA?

Would appreciate some configuration examples or better/more manageable solution ideas.

I realize I'm asking a lot, and I have no problems with starting new questions for each topic that spawns from this if needed.

Thank you in advance


ZF
LVL 12
zoofanAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

John MeggersNetwork ArchitectCommented:
If I'm understanding you correctly, you want your two ASAs to act as a failover pair.  That's no problem, and let's ignore the second ISP for the moment.  What you really want to to is a single outside interface and use static NAT to translate the inside addresses of the different services (HTTP, FTP, etc.) to addresses that are in the outside subnet.  You don't want to use separate physical interfaces for these functions, and the ASA will not let you assign addresses from the same block to different interfaces.  The ASA configuration guide has lots of information on how to configure static NAT, but a basic command that will translate an external address of 209.165.201.12 to an internal address of 10.1.1.3 looks like:

static (inside,outside) 209.165.201.12 10.1.1.3 netmask 255.255.255.255

For the second ISP connection, you will .  The ASA can have connections to two ISPs but you won't effectively be able to use both of them at the same time.  Load balancing or load sharing is not supported on the ASA.  See http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml for a configuration example.  

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
zoofanAuthor Commented:
Hi jm,

static (inside,outside) 209.165.201.12 10.1.1.3 netmask 255.255.255.255 <- has been depreciated and no longer a valid NAT command for asa 8.3 and above as far as I can tell.
I googled and found the replacement.

However I did:
e0/0 no ip connected to dsl modem
e0/1 lan ip connected to lan

add a static nat's for
ext-ip1 <----> int-s01
ext-ip2 <----> int-s02
ext-ip3 <----> int-s03
ext-ip4 <----> int-s04
ext-ip5 <----> int-s05
and added access-list rules for appropriate ports and traffic.

This seemed to be working ok.  So I then assigned ext-ip6 to e0/2 and connected it to the dsl modem
Configured a anyconnect client-access vpn to this interface.
Connected and that worked.
SWEET!!

Is it possible to also have a site-site with all this as well?
As the VPN requires a ip assigned to an interface, and the ASA will not allow two ips on the same subnet on different interfaces.... any thoughts?



thanks,

zf
0
zoofanAuthor Commented:
Any idea if I can have two vpn's (client/site) tied to the same int/ip and connected at the same time?

zf

0
zoofanAuthor Commented:
Got that too!! It will allow two vpn's to the same interface  thank you for your help.

zf
0
zoofanAuthor Commented:
Thank you for the nudge in the right direction!!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Hardware Firewalls

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.