2

We have two providers. I want to make the second provider a backup channel.

This configuration is most often offered:

object network internal-pat-primary_obj
 nat (inside,outside1) dynamic interface
object network internal-pat-secondary_obj
 nat (inside,outside2) dynamic interface
!
sla monitor 1
 type echo protocol ipIcmpEcho 8.8.4.4 interface outside1
sla monitor schedule 1 life forever start-time now
!
track 1 rtr 1 reachability
!
route outside1 0.0.0.0 0.0.0.0 62.105.149.225 1 track 1
route outside2 0.0.0.0 0.0.0.0 200.112.100.137 100

Is it possible on the ASA to implement switching using Route-Map?

Improve this question
0

1 Answer 1

Reset to default
4

What you're referring to is PBR (Policy Based Routing). It allows you to route based on criteria other than destination (like a static route limits you to), such as source network, protocol, port, etc.) to route traffic differently. On ASAs, PBR was introduced in 9.4(1).

Improve this answer
8
  • 1
    @Ruslan Yes, it's possible. You would need to tell us more, though, like what criteria you want to use to determine which provider things route through, before we can provide sample code for you to use.
    – Jesse P.
    Jul 8, 2019 at 16:01
  • 1
    @Ruslan I see it was edited but I don't see any difference. In any case, it still doesn't tell us what you want to use to determine which traffic routes through the secondary ISP. You need to tell us something like, " I want all TCP/80 and TCP/443 traffic to go through the secondary ISP" or something like that, so we know what you want to do.
    – Jesse P.
    Jul 9, 2019 at 11:18
  • 1
    @Ruslan If all you want is to keep the secondary ISP as a backup (don't use them unless the primary ISP goes down), the SLA and Track statement you have is what you want.
    – Jesse P.
    Jul 9, 2019 at 11:19
  • 1
    @Ruslan In theory, you could, though I don't know why you'd want to complicate it so much. You could possibly have the ACL in a route-map set to match all traffic (0.0.0.0 0.0.0.0 or "any") and then use a track statement in the route-map action, like set ip next-hop verify-availability x.x.x.x track <track number> to determine that it's safe to use the policy and not route through the other path, followed by another set ip next-hop y.y.y.y 254 (no verify-availability or track statement, just a metric) as a failover.
    – Jesse P.
    Jul 9, 2019 at 11:56
  • 1
    @Ruslan If I've answered your question adequately, please mark is as the accepted answer so this question doesn't continue to pop up as unanswered.
    – Jesse P.
    Jul 9, 2019 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.