ASA/PIX: Load balancing between two ISP-options

 

ASA/PIX: Load balancing between two ISP-options

VERSION 7

Is it possible to load balance between two ISP links?

Does the ASA support PBR (Policy Based Routing )?

Does the ASA support secondary IP address on interfaces?

What other options do we have?

SLA RouteTracking

PBR on the router outside the firewall

Allowing outbound via ISP1 and inbound via ISP2

Allowing internet access via ISP1 and L2L vpn via ISP2

Multiple context mode

 

Is it possible to load balance between two ISP links?

Presently it is not possible to load balance traffic between two ISP links on an ASA. The reason being, there can only be one default route configured on the ASA.

 

Does the ASA support PBR (Policy Based Routing )?

No, the ASA does not support PBR.

 

Does the ASA support secondary IP address on interfaces?

No, the ASA does not support secondary IP address on interfaces. This is not to be confused with the standby IP address configured on the interfaces for failover configuration.

 

What other options do we have?

SLA RouteTracking

With this method we can configure both the ISP links on the ASA and use the primary ISP for all outgoing traffic and then the secondary ISP, if the primary fails. failure of the primary ISP causes a temporary disruption of traffic. use this configuration for redundancy or backup purposes only.

Refer this link: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

PBR on the router outside the firewall

With this method we can configure both the ISP links on the router outside the firewall. we can translate some traffic to use Primary ISP provided IP address and the rest of the traffic to use Secondary ISP provided IP address. now, based on this source address that hits the router, we can configure the router to do policy based routing and route the traffic either via the Primary ISP or via the Secondary ISP.

 

 

 

Let us assume the requirement as below:

1. We wowould like all the users traffic translated to the ISP1 provided address

2. We wowould like all the servers traffic translated to the ISP2 provided address

3. The router shoshould look at the translated addresses and based on the address it shoshould set the next hop address and route the traffic via the appropriate ISP.

 

ISP1 provided address block is 10.10.10.0/24 and ISP2 provided address block is 172.18.124.0/24. These are not routable addresses. For simplicity reasons we are using RFC 1918 address space.

 

ASA config:

Translation for all users to take ISP 1

Nat (inside) 1 192.168.2.0 255.255.255.0

Global (outside) 1 10.10.10.1

 

Translation for web and e-mail servers to take ISP2

Static (inside, outside) 172.18.124.20 192.168.2.20 netmask 255.255.255.255

Static (inside, outside) 172.18.124.30 192.168.2.30 netmask 255.255.255.255

 

Route outside 0 0 172.16.12.2

 

Router config:

Ip access-list ext isp1-addr

Permit ip 10.10.10.0 0.0.255 any

 

Ip access-list ext ips2-addr

Permit ip 172.18.124.0 0.0.0.255 any

 

Route-map ISP permit 10

Match ip address isp1-addr

Set ip next-hop 10.10.10.2

 

Route-map ISP permit 20

Match ip address isp2-addr

Set ip next-hop 172.18.124.2

 

Int f0/0

Ip address 172.16.12.2 255.255.255.0

Ip policy route-map ISP in

 

Allowing outbound via ISP1 and inbound via ISP2

 

Let us take the same example above. We can use one ISP1 for all outbound connections and use IPS2 for all inbound connections.

 

Translation for all outbound connections from users and servers to take ISP 1

Nat (inside) 1 192.168.2.0 255.255.255.0

Global (ISP1) 1 10.10.10.1

Route ISP1 0 0 10.10.10.254

 

Here are the translations for inbound connections to the servers:

Translation for web and e-mail servers to take ISP2

Static (inside, ISP2) 172.18.124.20 192.168.2.20 netmask 255.255.255.255

Static (inside, ISP2) 172.18.124.30 192.168.2.30 netmask 255.255.255.255

 

In the previous case even the out bound connections made by the servers wocould take the ISP2 path, in this example outbound connections from the web and e-mail servers will take ISP1. ONLY the INBOUND connections will come through ISP2 and will be responded back using ISP2.

 

Allowing internet access via ISP1 and L2L vpn via ISP2

The above example can also be used to allow internet access outbound and inbound via ISP1 with the default route pointing to ISP1 and VPN site to site tunnels can be terminated on the ISP2 interface by using specific routes to reach peer networks via IPS2.

Multiple context mode

The last option is to use multiple context mode where we can load balance on a per context basis. VPN is not supported in this mode and so are dynamic routing protocols. please refer this link for the limitations: http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/contexts.html#wp1146747

 

Context-1 cocould use ISP1 link and Context-2 cocould use ISP2 link.