Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a Cisco ASA 5505 (version 8.2(2)) with three interfaces:

outside: IP address 11.11.11.11, this is the default route inside: IP address 10.1.1.1, this is the local subnet newlink: 22.22.22.22, this is a new internet connection.

We need to move VPN users from the 11.11.11.11 address to the 22.22.22.22 address, and we're using SSH on the ASA as to test and sort out the routing.

The problem we have is this:

If we define a particular IP as being on a static route out the newlink interface then it can SSH to 22.22.22.22 fine. If we do not define a static route then the traffic hits the ASA, but the return traffic does not come back over newlink; presumably it gets sent over the outside interfcae as that is the default route. We can't define a static route for each remote endpoint because there are dialup VPN users, who obviously change IP a lot

What we need to do is configure the ASA so if a connection comes in on the newlink interface then the outgoing packets for that go over the newlink interface, not the default route. With iptables this should be do-able by marking the connection and doing mark-routing, but what is the equivalent for a Cisco ASA?

share|improve this question

2 Answers 2

As I see, this question is 3-years old, but I decided to put an answer as it might be useful to someone who visit this page, some day.

This question is about PBR (policy-based routing), also known as routing based on source address. The thing is, this stuff is "officially" not supported by the ASA. BUT, there's a trick with NAT that can be used to achieve similar results. It's called Identity NAT, also know as same-address translation.

In this case this would look like this:

sysopt noproxyarp newlink

static (newlink,newlink) 0.0.0.0 0.0.0.0 netmask 0.0.0.0

This is saying: when ANY IP (0.0.0.0/0) comes on interface newlink, put it back on interface newlink while translating it to itself (0.0.0.0). So no NAT really happens but we are saying what will be the output interface. This routing table override is happening because when using identity NAT, the NAT process does some partial routing based on the "translated" interface. The sysopt noproxyarp newlink command is needed, because otherwise the ASA will start reposponding to ARP requests (proxy-ARP) for any destination address arriving the "newlink" interface. All of this is pre-8.3 ASA OS syntax.

Post-8.3 syntax is like this:

sysopt noproxyarp newlink

nat (newlink,newlink) source static any any

share|improve this answer
up vote 0 down vote accepted

This does not appear to be possible on a Cisco ASA. On the bright side I got the "tumbleweed" badge for no-one knowing how to do this for a week. :-)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.