0

I work in a very small software development team where we (just about) manage a couple of Cisco ASAs (model 5510, version 8.4). None of us are Cisco experts.

We are attempting to increase our redundancy and during our discussions the following question came up.

Can an ASA 5510 be configured to inspect a packets destination IP address, detect if the target machine is up and re-direct to a different IP address if it isn't?

My understanding was that this was a server farm management software function rather than a router function but one of our team thought that perhaps the ASA can do it as it's more than just a router.

If so, would anyone be able to tell me the name of the protocol/technology so I can do some research and learn how it works?

I turn to Stack Exchange because my research so far has only uncovered articles about failover and alternative links between routers.

Any nudge in the correct general direction would be greatly appreciated.

Thank you for taking the time to read my question.

J.M.

Improve this question
2
  • That's not a firewall function. It is something more like a server farm appliance would do. – Ron Maupin♦ May 22 '17 at 8:05
  • Thanks Ron, that stops us from wasting any more time in that area. Thanks for your reply. – J.M. May 22 '17 at 13:05
2

ASA is a firewall and it can't act as load-balancer/proxy/etc.

Improve this answer
2
  • Thank you for your reply Andrey, I've selected your answer (but would have liked to give to credit to Ron who provided the same answer via a comment). I suspected that it wasn't possible but it is nice to know we can move on and rule this avenue out. – J.M. May 22 '17 at 13:07
  • Thank you. Unfortunately my reputation at this time not allows me to leave comments under questions. – Andrey Prokhorov May 22 '17 at 14:43
1

There is one way to approach this with just an ASA by using a feature called tracking. Essentially what it does is use some sort of test (typically a ping) to track the availability of a resource, and add/remove a static route from the ASA's routing table depending on the status

See : ASA Config Guide: Configuring Static and Default Routes

I assume you are trying to do this for a set of servers. Let's say you have two servers, A and B, and you want them to be accessible through a shared IP IPV.

In this case you could create a loopback interface on each of the servers with the IPV address, and then use tracking to manage two static routes towards IPV/32:

  • One towards the IP of server A, which you associate with a tracking on that same IP.
  • One towards the IP of server B, which you create with a higher admin distance than is normal for static routes, such that it will only be used if the first route is not in the routing table.

Note that this is not a highly intuitive solution, so I would encourage you to use an actual load balancing system (like Microsoft NLB if you are in a Windows environment) rather than resorting to something like this which you may have difficulty troubleshooting over time.

Also, if you are trying to manage not different servers but different Internet links, you can use the tracking feature there as well.

Improve this answer
7
  • How does this rewrite the destination IP address in the packet header? – Ron Maupin♦ May 22 '17 at 10:50
  • Thank you for taking the time to reply Jeremy. We will probably not go down this route because (as you say) it's better to go for a proper load balancer. However, I will be reading up on tracking anyway out of interest. Thank you again for taking the trouble to answer. – J.M. May 22 '17 at 13:09
  • @J.M. tracking is a great tool for routes and things like HSRP, but it doesn't actually change the destination IP address in a packet. Look for Cisco Enhanced Object Tracking. – Ron Maupin♦ May 22 '17 at 13:30
  • Thanks Ron, I will do. Thanks again to you all for your replies. – J.M. May 22 '17 at 14:10
  • @RonMaupin It doesn't, hence the loopbacks on the servers that are all identically configured with the virtual IP. It's similar to the "Direct Server Response" mode that you get on traditional load balancers. – Jeremy Gibbons May 22 '17 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.