I am deploying a CISCO ASA 5506X as part of larger network segmentation and cleanup to improve security.

Currently we have two SOHO routers connecting to two different ISPs. One handles strictly three web exposed servers (they are statically configured to use it as gateway), while other router provides actual default gateway for all devices on network.

I would like to replace both SOHOs with one ASA if possible. I would like to enable internet access like this:

  • VLAN10,20,30,40,50 via ISP1
  • VLAN210,220,230 via ISP2

Both ISPs are statically configured and do not use DHCP.

I have configured interfaces 1/1 and 1/2 to be outside1 and outside2 respectively, and 1/3 has been configured with multiple subinterfaces to handle each VLAN over a trunk to L2 CISCO switch.

Am I correct in assuming that this is done using Route Maps with Policy Based Routing, by creating ACL that matches desired source VLANs and then setting Default Next Hop IP to be that of desired ISP default gateway?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.