I have a requirement to build a network that has 3 internet feeds, 2 of which will be designated to VLANS 10-20 and the 3rd feed for VLAN 30 (only). I have in my posession the following hardware:
- ASA 5510
- Cisco 3560X switch
- 3 x 2911 routers
The idea would be to have the switch act as the core whereby all VLAN's are distributed, each having an SVI on the same switch which will act as the gateway for users behind each VLAN i.e. VLAN10 SVI will be 172.16.10.1, VLAN30 SVI will be 172.16.30.1 etc;
The problem arises in the fact that the ASA will not do policy routing and hence, need a router to do the routing to the relevant ISP's. I have a design in mind however am a little hesitant that it'll work and thus, would greatly appreciate if somebody could validate it.
I have a /29 and a /30 to each ISP; i'll be using the /30 to get to the public internet space, with the /29 being used for various services/clients sitting behind the switch, of which i'd like to have the ASA act as the NAT/inspection box.
The plan would be to do a static NAT on the ASA for certain VLAN's to an IP on the 172.16.251.0/24 subnet, i'll then configure PBR on 2911-1 to match this source subnet and route it out the correct interface and hence, the correct ISP.
There is a requirement for VLAN10-20 to be able to failover between ISP's however i can easily implement IP SLA on 2911-2 to sort this out. As a worst case, if ISP3 was to be taken out by a backhoe, there would be a need to route this traffic out via ISP1 or ISP2, again, easily done by fixing policy route on 2911-1.
Given the design, it seems as though there are too many private networks between the 2911's however i could just be over-analyzing the layout.
I know there is a workaround to have the ASA do pseudo-policy-routing with the use of NAT rules, however i'd prefer a supported (and scalable) solution. So as it stands, my options are -
- Implement the above design - assuming the design is correct and will work
- Use the ASA to do policy routing - not supported
- Sit the ASA in transparent mode; doing inspection (and even NAT, albeit not being required).
If anybody can lend me a hand, that would be excellent!