1

I need help about configuration firewall ASA 5505 connected to 02 wan connections

interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.254.1 255.255.255.252 


interface Vlan2
 description LINK TO THE OUTSIDE - INTERNET
 nameif outside
 security-level 0
 pppoe client vpdn group ******
 ip address pppoe setroute 

interface Vlan3
 description Link Wan  Router 2
 no forward interface Vlan2
 nameif outside2
 security-level 0
 ip address 192.168.50.1 255.255.255.252 

interface Ethernet0/0
 switchport access vlan 2            

interface Ethernet0/1
 switchport access vlan 3

object network obj_any
 nat (inside,outside) dynamic interface



route outside2 x.x.x.x 255.255.255.255 192.168.50.2 1
route outside2 y.y.y.y 255.255.255.255 192.168.50.2 1
route outside2 z.z.z.z 255.255.255.255 192.168.50.2 1

route 0.0.0.0 0.0.0.0 (pppoe path)  // to internet

route inside a.a.a.a 255.255.255.0 internal_gw_ip
route inside b.b.b.b 255.255.255.0 internal_gw_ip
route inside c.c.c.c 255.255.255.0 internal_gw_ip


access-list 101 extended permit ip host x.x.x.x any 
access-list 101 extended permit ip host y.y.y.y any 

access-group 101 in interface outside2

The internet works but no communication between (inside to outside2) or (outside2 to inside)

2
  • What firmware version is on the ASA?
    – Epaphus
    Dec 27, 2012 at 12:27
  • do you have address-space that is portable across providers? Dec 27, 2012 at 15:18

2 Answers 2

2

ASAs can only use one WAN connection at a time (even in the latest 9.x firmware). You can configure WAN redundancy with sla monitors and the track argument to your default routes.

For example:

sla monitor 10
 type echo protocol ipIcmpEcho 8.8.8.8 interface onecomm
sla monitor schedule 10 life forever start-time now
sla monitor 20
 type echo protocol ipIcmpEcho 8.8.4.4 interface comcast
sla monitor schedule 20 life forever start-time now

route wan0 0.0.0.0 0.0.0.0 192.0.2.137 1 track 10
route wan1 0.0.0.0 0.0.0.0 198.51.100.46 2 track 20

Note 1: it's not necessary to put SLA monitors on both, but wanted to show it in case anyone seeing this has more than 2 connections, it's pretty easy to figure out how to configure the ASA for an arbitrary number of connections.
Note 2: The only harm in configuring as many monitors as you have WAN connections, if both connections go down there would be no default route, which is a problem if you use "far" monitoring targets. The example uses Google's DNS servers, which are not on the local links. If you used the DG of the link then the target is always local; this has the trade-off of a connection being considered "up" even if there are problems upstream of your connection...

TL;DR ASAs can not do load-balancing across multiple WAN connections. The only support redundancy. There are other devices available that can do load-balancing of course...

0

Have you got the matching nat statement for your outside2 link? you only have one in the config you posted. you would need this:

object network obj_any2
 nat (inside,outside2) dynamic interface

As long as you have the security plus licence you will be able to use routes to allow traffic to pass through both interfaces as you have configured.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .