Triple-WAN load-balancing

Question

I have a requirement to build a network that has 3 internet feeds, 2 of which will be designated to VLANS 10-20 and the 3rd feed for VLAN 30 (only). I have in my posession the following hardware:

• ASA 5510
• Cisco 3560X switch
• 3 x 2911 routers

The idea would be to have the switch act as the core whereby all VLAN's are distributed, each having an SVI on the same switch which will act as the gateway for users behind each VLAN i.e. VLAN10 SVI will be 172.16.10.1, VLAN30 SVI will be 172.16.30.1 etc;

The problem arises in the fact that the ASA will not do policy routing and hence, need a router to do the routing to the relevant ISP's. I have a design in mind however am a little hesitant that it'll work and thus, would greatly appreciate if somebody could validate it.

I have a /29 and a /30 to each ISP; i'll be using the /30 to get to the public internet space, with the /29 being used for various services/clients sitting behind the switch, of which i'd like to have the ASA act as the NAT/inspection box.

The plan would be to do a static NAT on the ASA for certain VLAN's to an IP on the 172.16.251.0/24 subnet, i'll then configure PBR on 2911-1 to match this source subnet and route it out the correct interface and hence, the correct ISP.

There is a requirement for VLAN10-20 to be able to failover between ISP's however i can easily implement IP SLA on 2911-2 to sort this out. As a worst case, if ISP3 was to be taken out by a backhoe, there would be a need to route this traffic out via ISP1 or ISP2, again, easily done by fixing policy route on 2911-1.

Given the design, it seems as though there are too many private networks between the 2911's however i could just be over-analyzing the layout.

I know there is a workaround to have the ASA do pseudo-policy-routing with the use of NAT rules, however i'd prefer a supported (and scalable) solution. So as it stands, my options are -

1. Implement the above design - assuming the design is correct and will work
2. Use the ASA to do policy routing - not supported
3. Sit the ASA in transparent mode; doing inspection (and even NAT, albeit not being required).

If anybody can lend me a hand, that would be excellent!

Thanks guys

Answer 1

Your design in the diagram is a reasonable approach. Do policy-based routing on 2911-1, and do you NAT on the border routers.

An alternative, if you can use contexts, is to connect VLAN 30 directly to the ASA (either with a different interface, or use sub-interfaces and a VLAN trunk. Make the ASA the default gateway. Connect 2911-3 similarly with a separate interface. Now you can create a separate context for VLAN 30 traffic, and direct it to ISP 3. This may or may not be practical, depending on your situation.