Cisco ASA with Dual ISPs one for Internet and one for VPN example

I had a situation recently where  the 2Mb Internet connection at one of our offices was becoming congested. To try and allieve the congestion I had a new ADSL line installed at the office with the intention on splitting traffic through the ASA. On the ASA 5505 it is not possible to load balance beween the ISPs, so I thought I would leave the exisitng 2Mb connection for VPN traffic only and use the new ADSL connection for Internet traffic. It took me a while to figure out how to do this, and so I thought I would document it here, because actually the solution is pretty simple.

In order to achieve this all you have to do is set up static routes to define the default route through one connection, and the remote VPN peer, and traffic destined for the remote LAN subnet through the other connection. The diagram below explains the set up in a bit more detail:

Cisco ASA with 2 ISPs one for Internet and One for VPN

Cisco ASA with 2 ISPs one for Internet and One for VPN

Firstly set up 3 vlans and their interface associations:

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

interface Ethernet0/3

interface Ethernet0/4

interface Ethernet0/5

switchport access vlan 12

interface Ethernet0/6

interface Ethernet0/7

interface Vlan1

nameif inside

security-level 100

ip address

interface Vlan2

nameif VPN

security-level 0

ip address

interface Vlan12

no forward interface Vlan1        (If using a security plus or higher license on your ASA 5505 you may not need this command in your set up)

nameif Internet

security-level 50

ip address

You then need to configure your static routes:

route Internet 1 

(ASA sends all traffic out of this default route via the ISP 1 ADSL connection, unless defined in the other static routes below)

route VPN 1   

 (This static route sends all traffic destined for the remote office subnet i.e. the interesting traffic defined for encryption, over the VPN via the ISP 2 connection)

route VPN 1  

(This static route sends all traffic destined for the remote office VPN Peer via the ISP 2 connection)

The actual setup of the site to site VPN connection is beyond the scope of this article but there is plenty of information elsewhere.


allow PPTP client through Cisco ASA 8.4 to external PPTP server

In order to allow a PPTP VPN client through a Cisco ASA firewall in order to access an external PPTP server you need to add the following to your configuration.

policy-map global_policy

class inspection_default

inspect pptp

Restart a VPN tunnel on a Cisco ASA or PIX

To reset and restart VPN tunnels on a Cisco ASA or PIX firewall simply type:

clear crypto isakmp sa