Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two outside interfaces, A and B. Let's say I want all traffic going in or out on port 1000 and 2000 to be directed to A, while all other traffic should go to B.

So client is accessing a web page (80 or 443). That goes out thru B. Client accesses port 1000. That goes out thru A.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

It sounds like you're looking for policy based routing (PBR). That is not supported on the ASA, you would have to use a Cisco IOS device (router or switch) to use PBR. http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_qanda_item09186a00805b87d8.shtml#supportfeat (no PBR on ASA).

We used PBR on a Cisco 1841 router to ease the transition when we switched ISP's. http://www.cisco.com/en/US/products/ps6599/products_white_paper09186a00800a4409.shtml (PBR doc for IOS).

share|improve this answer

Almost. PBR is a feature specific to Cisco IOS (routers and switches). The ASA has the means to accomplish what you are attempting to do. The ASA calls it "Policy NAT".

Policy NAT is simply using an access-list within a regular Static NAT or Dynamic NAT statement. This gives you much more flexibility in defining "what" you are trying to NAT. In regular Static/Dynamic NAT, the only criteria you have to specify what you should NAT is the source IP. With Policy NAT, you have an access-list, which allows you to use Source IP, and Source Port, Destination IP, Destination Port, and Protocol.


On second read, however, it appears you aren't necessarily concerned with NATing, but with Routing. That is rather odd. Does the connection to port 1000/2000 that needs to go out interface A go to a specific IP or Network? Normally ports aren't what is used to distinguish where traffic goes. If you could provide additional detail in what you are trying to accomplish, I'm sure we could think of something to accommodate.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.