4

I currently have two internet connections coming into my main office. The primary connection is regular static IP cable service and the secondary is a dedicated MPLS Ethernet connection. The primary cable internet terminates at an ASA 5510 (192.168.0.5) and the secondary internet connection terminates at an ASA 5550 (192.168.0.7). Both reside on the 192.168.0.0/24 network and are connected to a 4500-e switch with a 6L-E supervisor. The 192.168.0.0/24 network uses an ISR 2851 (192.168.0.1) router as the default gateway providing connectivity to 3 other offices through private IP service.

enter image description here

For a few years now all I had in the way of internet service was the static IP cable service. I had a default route in the 2851 gateway router "ip route 0.0.0.0 0.0.0.0 192.168.0.5" and all hosts on the 192.168.0.0/24 network were able to access the internet. However now I've come across a situation where I have one specific server (192.168.0.100) that needs to exclusively use my new secondary MPLS internet connection. For the life of me I cannot figure out how to get this to work. I only have limited access to the network settings on this server and can only configure things like the IP/mask and default gateway. I've tried adding a second default route on the gateway router but that didn't work. Any help would be much appreciated as I think I'm in over my head on this one. Thanks a lot!

Improve this question
9
  • maybe I didn't understand correctly: You want the server have 192.168.0.7 as default gateway, but between it and the server there is the ISR 2851?
    – feligiotti
    Commented May 15, 2015 at 9:45
  • Sorry I should have been a little more clear. All hosts on the 192.168.0.0/24 network use the 2851 (192.168.0.1) as their gateway, so I also need the server (192.168.0.100) to use the 2851 as it's gateway too. Because if I don't, I would then lose all access to my other offices. So somehow I need the 2851 to send all internet packets coming from the server (192.168.0.100) to the secondary ASA (192.168.0.7) instead of the primary ASA. It goes to the primary ASA right now because the 2851 has a default route (0.0.0;0 0.0.0.0 192.168.0.5) sending all internet requests to the primary ASA.
    – Cragmuer
    Commented May 18, 2015 at 9:15
  • I add an image to explain the situation. Please check if correct. In my opinion the simplest solution is to manipulate the routing table of the server (def gateway ASA.5, internal route to 2851. But... if you can't do it...
    – feligiotti
    Commented May 19, 2015 at 14:36
  • premise, no expirience on ASA, so that's just a question: if you connect the server "directly" to ASA.7 is possible to configure it to route internal traffic to 2851, then the exernal via ISP?
    – feligiotti
    Commented May 19, 2015 at 15:29
  • 1
    Thanks for your help gio900, it's much appreciated! Unfortunately I cannot edit anything beyond the basic network settings of the server. I've asked the vendor but they won't allow it. The diagram you've added (thanks BTW) is correct. The routing table on the 2851, besides the routes for my other offices, only has one default route "0.0.0.0 0.0.0.0 192.168.0.5" which sends all internet traffic on the 192.168.0.0/24 network to the primary ASA.5.
    – Cragmuer
    Commented May 20, 2015 at 9:37

1 Answer 1

Reset to default
4

ip policy route-map

that command permit to create differentiate policy to the routing table:
http://www.ciscozine.com/pbr-route-a-packet-based-on-source-ip-address/

create an acl to define the traffic to internet that shall pass on ASA7

2851(config)# ip access-list exended SERVER
2851(config-ext-nacl)# deny ip any 192.168.0.0 0.0.3.255
2851(config-ext-nacl)# permit ip host 192.168.0.100 any

create a route-map to ASA7 destination

2851(config)# route-map ASA7
2851(config-route-map)# match ip address SERVER
2851(config-route-map)# set ip next-hop 192.168.0.7

apply the route-map to the correct interface (the one pointing to the asa)

2851(config)#interface fa0/0
2851(config-if)#ip policy route-map ASA7

I never try this command before, neither packet tracer permit me a simulation, so no refound if don't work correctly! ;)

Improve this answer
1
  • hi @Cragmuer, did it resolve your issue?
    – feligiotti
    Commented May 22, 2015 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.