I have a requirement to build a network that has 3 internet feeds, 2 of which will be designated to VLANS 10-20 and the 3rd feed for VLAN 30 (only). I have in my posession the following hardware:

  • ASA 5510
  • Cisco 3560X switch
  • 3 x 2911 routers

The idea would be to have the switch act as the core whereby all VLAN's are distributed, each having an SVI on the same switch which will act as the gateway for users behind each VLAN i.e. VLAN10 SVI will be, VLAN30 SVI will be etc;

The problem arises in the fact that the ASA will not do policy routing and hence, need a router to do the routing to the relevant ISP's. I have a design in mind however am a little hesitant that it'll work and thus, would greatly appreciate if somebody could validate it.

I have a /29 and a /30 to each ISP; i'll be using the /30 to get to the public internet space, with the /29 being used for various services/clients sitting behind the switch, of which i'd like to have the ASA act as the NAT/inspection box.

enter image description here The plan would be to do a static NAT on the ASA for certain VLAN's to an IP on the subnet, i'll then configure PBR on 2911-1 to match this source subnet and route it out the correct interface and hence, the correct ISP.

There is a requirement for VLAN10-20 to be able to failover between ISP's however i can easily implement IP SLA on 2911-2 to sort this out. As a worst case, if ISP3 was to be taken out by a backhoe, there would be a need to route this traffic out via ISP1 or ISP2, again, easily done by fixing policy route on 2911-1.

Given the design, it seems as though there are too many private networks between the 2911's however i could just be over-analyzing the layout.

I know there is a workaround to have the ASA do pseudo-policy-routing with the use of NAT rules, however i'd prefer a supported (and scalable) solution. So as it stands, my options are -

  1. Implement the above design - assuming the design is correct and will work
  2. Use the ASA to do policy routing - not supported
  3. Sit the ASA in transparent mode; doing inspection (and even NAT, albeit not being required).

If anybody can lend me a hand, that would be excellent!

Thanks guys

  • I should add; we have no BGP peering in place. Thanks again
    – ik_tech
    Aug 26, 2014 at 11:30
  • Are you using your own public IP space, or are you getting separate IP ranges from each ISP?
    – Ron Trunk
    Aug 26, 2014 at 12:09
  • I have /30's to each ISP, as well as /29's from each ISP. I'll be using the /30's to exit my network (as shown in the diagram), and have the /29's at my disposal to assign to a few servers on VLAN30; VLAN10-20 only need outbound, no inbound services. Thanks
    – ik_tech
    Aug 26, 2014 at 12:22
  • my other option is to not do any NAT on the ASA, but rather do NAT on the edge boxes; 2911-2 and 2911-3. Thoughts?
    – ik_tech
    Aug 26, 2014 at 12:26
  • Farisi, I'm afraid I didn't make my question clear: do you have your own /29 that you can advertise to each ISP, or, does each ISP give you a /29 from their own IP space?
    – Ron Trunk
    Aug 26, 2014 at 12:27

1 Answer 1


Your design in the diagram is a reasonable approach. Do policy-based routing on 2911-1, and do you NAT on the border routers.

An alternative, if you can use contexts, is to connect VLAN 30 directly to the ASA (either with a different interface, or use sub-interfaces and a VLAN trunk. Make the ASA the default gateway. Connect 2911-3 similarly with a separate interface. Now you can create a separate context for VLAN 30 traffic, and direct it to ISP 3. This may or may not be practical, depending on your situation.

  • Thanks Ron - I had contexts in mind but may need to establish VPN's in the future. The other concern is the sec+ license requirement. Thanks again, i may go down the path of doing NAT on the edge routers.
    – ik_tech
    Aug 26, 2014 at 19:40
  • I agree that NAT should be done at the border as well.. Why the second router just for ISP 3 however? It seems redundant, unless there are throughput concerns? You could just as easily use policy routes to send VLAN 30 traffic to ISP 3 as well? Aug 28, 2014 at 2:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.