0

enter image description here

Good afternoon,

The network will be MPLS in the future and I am thinking about new design for it. We will have hub router with ASA behind and couple spokes without the need for IPsec (at least for now). ASA won't do any NAT at all, all will be controlled with ACLs on each interface, NAT will be done on HUB with PAT for LANs and Static for server in DMZ.

So Public facing interfaces on Routers are in VRF OUTSIDE. Then tunnels between them are also in VRF OUTSIDE. On hub, VRF OUTSIDE points into ASA. ASA does the inspection with Outside-In ACL. Then it points the traffic to Hub again BUT Hub's int facing ASA is in VRF INSIDE. Then that VRF has default route towards ISP's router + applies any NAT needed.

Am i correct?

Improve this question
2
  • So you are using two VRFs inisde and outside, what the reason of using VRF ?
    – Mr.lock
    Commented Aug 6, 2017 at 4:23
  • To make outside vrf have default route to ASA and coming traffic to hub from ASA have default traffic to ISP router. This should give me two default routes that I need to filter traffic through ASA. Unless there is other option You suggest?
    – papski
    Commented Aug 7, 2017 at 13:40

1 Answer 1

Reset to default
-1

Found what I wanted in the first link! http://lmgtfy.com/?q=pbr+between+dmvpn+tunnel+int

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.