ASA 5510 Route Question

Hub Hardware: Cisco ASA 5510, Software version 7.0(2)
Spoke Hardware: Pix 501, Version 6.x / 1600 Version 12.x

I'm currently in process of upgrading my classic PIX 520 to the new ASA 5500
platform. The last week has been slowly working through config changes, but
I'm almost complete. However, not only am I tossing in a hardware change,
but a provider change as well. Currently we have a single managed T1 for
internet access. However, through a deal with a different provider (who
just bought out our current provider), we are having 2 managed T1's
installed for internet access at 50% of the cost. I specifically requested
that these two T1's be kept seperate. My thought process was that I would
dedicate one T1 to strictly carry VPN traffic, while the other handles all
other internet traffic. By doing this, I hope to eliminate congestion to my
spoke VPN sites due to excessive internet traffic. With 4 interfaces
available, I have enough connections to make it all work.

However, here is where my problem that arrises when I use more than two
interfaces on the device. I take one interface (call it INET) and assign
security 0 and NAT to it for outbound traffic to the internet. The other
interface (called VPN) has no nat, but a crypto map assigned to it.
Currently, traffic is passing through each interface, just not both at the
same time. If I assign a static route for the INET interface, nat traffic
passes fine, but VPN traffic fails with no route to network. The opposite
occurs when I assign the default route to the VPN interface.

So my question is what is the "proper" way of handling this? Let's say the
hub network is 192.168.1.0/24 and each spoke is assigned a class C of
192.168.2.0/24-192.168.128.0/24. Some of these spokes are static addresses
so I can initiate the tunnel from either direction, but others are only
remotely initiated (dynamic map) from the spoke site due to them having a
dynamic address. We're not using all those subnets, but that's what I have
set asside for future growth. Should I, as part of configuring VPN
connectivity for each site, assign a static route for 192.168.X.0/24 to
point out the VPN interface on the 5500? This idea, while it should work,
wouldn't seem to scale well as the number of spokes increases. I haven't
seen anywhere in the PIX/ASA doc that allows for policy based routing. Is
there some other way that I can configure traffic for these spokes to pass
out the VPN interface rather than the INET interrface? Simply assigning a
crypto map to the VPN interfaces doesn't seem to trigger the device to make
this decision intelligently and I'd like to avoid static routes, if
possible.

Thanks,

Barry Lance
.

Relevant Pages

  • Re: ASA 5510 Route Question
    ... My thought process was that I would dedicate one T1 to strictly carry VPN traffic, while the other handles all other internet traffic. ... I hope to eliminate congestion to my spoke VPN sites due to excessive internet traffic. ... interface has no nat, but a crypto map assigned to it. ... Should I, as part of configuring VPN connectivity for each site, assign a static route for 192.168.X.0/24 to point out the VPN interface on the 5500? ...
    (comp.dcom.sys.cisco)
  • Re: IPSec tunnel to remote office; need proper static routes for RRAS
    ... At the remote office, I have a hardware ... IPSec VPN tunnel according to http://support.microsoft.com/kb/816514 ... But the static route described in the KB article doesn't work. ... External interface: 67.100.185.126 ...
    (microsoft.public.windows.server.networking)
  • Re: VPN Adding a static route to the client
    ... the problem is that the interface doesn't exist until the ... script which can get the "received" IP and plug it into the static route. ... And you can do it with CMAK (connection ... > I think what Rick is saying is that he doesn't want to have ALL of the VPN ...
    (microsoft.public.windows.server.networking)
  • Re: Direct Dial Routing Issue
    ... in order to get the VPN to work this is the static route I ... Network Mask: 255.255.255.0 ... Interface: office_vpn ...
    (microsoft.public.win2000.ras_routing)
  • Re: Configuring Cisco VPN Client / Windows XP
    ... Packets will use an interface based on the routing table. ... Generally speaking when the VPN is connected it will add a route to the ... flush the DNS Cache resolver to clear out the old DNS ... > cannot access the *same* pages on the computer with the VPN client ...
    (comp.dcom.vpn)