0

I use Cisco ASA in branches of our organization. Each device has an IPsec tunnel that connects to the main office. To access the global network each device also has a NAT. Recently, a task arose to forward all branch traffic into the tunnel to the main office and access Internet through the main office device.

So I have to create some kind of set of rules that will switch Internet connection from tunnel to local NAT if we have an accident in main office. Is exist some kind of mechanism on Cisco ASA looks like a SLA Monitor that can shutdown NAT rules? Can I use PBR for this task?

Thank you in advance.

Improve this question
5
  • 3
    Why do you want to NAT? You should not use NAT for intra-company networks. Simply use routing and avoid all the problems and limitations of NAT. NAT is not a substitute for routing.
    – Ron Maupin ♦
    Jan 18, 2022 at 16:58
  • @RonMaupin I left the answer below. We need a backup connection in case the HQ device suddenly stops working.
    – Ruslan
    Jan 18, 2022 at 20:33
  • You should use a dynamic routing protocol to automatically switch your routing to a different tunnel when the first tunnel goes down. This all seems to be Routing 101.
    – Ron Maupin ♦
    Jan 18, 2022 at 21:19
  • You can use a "tracked" route to change the default GW when the tunnel is down. (i.e. apply a lower metric route)
    – Ricky
    Jan 19, 2022 at 5:06
  • Yes use policy based routing (PBR) configuration on traffic routing from any one of tunnel .. so we can have control over traffic among both tunnel..
    – Sagar Uragonda
    Jan 27, 2022 at 19:00

1 Answer 1

Reset to default
2

I have to create some kind of set of rules that will switch Internet connection from tunnel to local NAT

Don't use NAT with the tunnel interface. Your local, private IP addresses make perfect sense to the main office routers, so there's absolutely no reason to use NAT. NAT is a kludge, an ugly hack that is required to connect private networks to public ones. All NAT happens in the main office, so there's no sense in translating before the tunnel.

You need to point your router's default route into the tunnel (interface). For it to still be able to connect to the HQ router, create a specific route to that destination with your former default gateway.

Before:

0.0.0.0/0 -> ISP gateway

After:

HQ public address/32 -> ISP gateway
0.0.0.0/0 -> VPN tunnel

The main office router requires policies to allow your branch office address range to connect to the Internet, using NAT. Done.

Improve this answer
2
  • Yes, it is rules to forward branch traffic through tunnel. I have already created these rules in some branches. But imagine the situation that the device in the central office does not work, and users in branches lose the way to Internet. So the NAT must be configured on branch device but only as backup configuration which is triggered if the IP of HQ has stopped pinging. I'm looking for a solution to implement auto-switching.
    – Ruslan
    Jan 18, 2022 at 20:25
  • 2
    You could create a second default route to the local ISP gateway with a high cost/metric.
    – Zac67 ♦
    Jan 18, 2022 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.