Solved

CISCO Static Routing

Posted on 2014-09-25
9
360 Views
Last Modified: 2014-09-26
Hi,

We have CISCO ASA 3750 L3 Switch and we want to do load balancing across to Internet lines.  The issue that I have is that we have 1-to1 NATs for some of our devices on the network and I know that we cannot have them go out both Internet lines

How can I create a static route to the firewall that has the NAT policies for those devices

for example:

device 192.168.1.1 needs its routes of last resort to go to 192.168.72.253

Thank you in advance
0
Comment
Question by:thomasm1948
  • 6
  • 3
9 Comments
 

Author Comment

by:thomasm1948
ID: 40344029
would something like this work and still allow the device to all of my other VLANS

access-list 1 permit 192.168.1.1

route-map NatGwy permit 1
set up next-hop 192.168.72.253

ip policy route-map NatGwy

I am not sure but I think policy based routing might work.  any ideas?
0
 

Author Comment

by:thomasm1948
ID: 40344114
After reading I think I might have to do this , but I am unsure

access-list 1 deny ip host 192.168.1.1 192.168.72.254 255.255.255.255 (new router gateway)
access-list 1 permit 192.168.1.1 any (allowing the host to have access to the other VLANs

 route-map NatGwy permit 1
 set up next-hop 192.168.72.253 (original gateway with the NAT policies)

 ip policy route-map NatGwy

Still unsure though
0
 
LVL 46

Expert Comment

by:Craig Beck
ID: 40344280
The ASA doesn't do PBR; only redundant links/routing.

The 3750 doesn't do NAT.

Either way, you probably won't get what you want unless you use a proper router upstream from the ASA on the outside.
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:thomasm1948
ID: 40344601
Hi,

Sorry used some wrong terminology.  The 3750 is our core L3 switch in which currently the last resort route goes to 0.0.0.0 0.0.0.0 192.168.72.253

We got a new Internet line in and the school would like to load balance between them.  The issue that I see is there is static NAT policies on their Pix firewall.  If I do load balancing then those devices such a web portal is not going to work correctly being that the traffic could possibly go out the new pix firewall
0
 
LVL 46

Expert Comment

by:Craig Beck
ID: 40344645
Ok, so load balancing is easy.  Just configure a second static route on the 3750 pointing to the new gateway and use the same metric.

You're right - static NAT will be a problem.  Where is your web portal?  Is it on your LAN but accessible from the internet?  If so, that's not going to work too well.  You will only be able to send that portal's traffic through one line at a time or it will break traffic, especially if it runs HTTPS.
0
 

Author Comment

by:thomasm1948
ID: 40344715
How can I route a single device through only one line and then have the rest do load balancing on the 3750.
0
 

Author Comment

by:thomasm1948
ID: 40344719
The web portal is on the LAN and is accessible for the teacher and students outside of the network
0
 
LVL 46

Accepted Solution

by:
Craig Beck earned 500 total points
ID: 40344761
0
 

Author Comment

by:thomasm1948
ID: 40344780
does the 3750 support that.  If so would my idea above work then
0

Featured Post

Create the perfect environment for any meeting

You might have a modern environment with all sorts of high-tech equipment, but what makes it worthwhile is how you seamlessly bring together the presentation with audio, video and lighting. The ATEN Control System provides integrated control and system automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Show IP BGP Information 10 43
Voice VLANs across Metro-E 4 36
ASA 5506 Port Forward 4 41
Microwave IP VPN or Wireless Bridging 26 46
Shadow IT is coming out of the shadows as more businesses are choosing cloud-based applications. It is now a multi-cloud world for most organizations. Simultaneously, most businesses have yet to consolidate with one cloud provider or define an offic…
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

761 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question