Cisco ASA with Dual ISPs one for Internet and one for VPN example

I had a situation recently where  the 2Mb Internet connection at one of our offices was becoming congested. To try and allieve the congestion I had a new ADSL line installed at the office with the intention on splitting traffic through the ASA. On the ASA 5505 it is not possible to load balance beween the ISPs, so I thought I would leave the exisitng 2Mb connection for VPN traffic only and use the new ADSL connection for Internet traffic. It took me a while to figure out how to do this, and so I thought I would document it here, because actually the solution is pretty simple.

In order to achieve this all you have to do is set up static routes to define the default route through one connection, and the remote VPN peer, and traffic destined for the remote LAN subnet through the other connection. The diagram below explains the set up in a bit more detail:

Cisco ASA with 2 ISPs one for Internet and One for VPN

Cisco ASA with 2 ISPs one for Internet and One for VPN

Firstly set up 3 vlans and their interface associations:

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

interface Ethernet0/3

interface Ethernet0/4

interface Ethernet0/5

switchport access vlan 12

interface Ethernet0/6

interface Ethernet0/7

interface Vlan1

nameif inside

security-level 100

ip address 10.0.1.254 255.255.255.0

interface Vlan2

nameif VPN

security-level 0

ip address 172.16.1.1 255.255.255.0

interface Vlan12

no forward interface Vlan1        (If using a security plus or higher license on your ASA 5505 you may not need this command in your set up)

nameif Internet

security-level 50

ip address 192.168.1.1 255.255.255.0

You then need to configure your static routes:

route Internet 0.0.0.0 0.0.0.0 192.168.1.254 1 

(ASA sends all traffic out of this default route via the ISP 1 ADSL connection, unless defined in the other static routes below)

route VPN 10.2.2.0 255.255.255.0 172.16.1.254 1   

 (This static route sends all traffic destined for the remote office subnet i.e. the interesting traffic defined for encryption, over the VPN via the ISP 2 connection)

route VPN 172.16.2.1 255.255.255.255 172.16.1.254 1  

(This static route sends all traffic destined for the remote office VPN Peer via the ISP 2 connection)

The actual setup of the site to site VPN connection is beyond the scope of this article but there is plenty of information elsewhere.

allow PPTP client through Cisco ASA 8.4 to external PPTP server

In order to allow a PPTP VPN client through a Cisco ASA firewall in order to access an external PPTP server you need to add the following to your configuration.

policy-map global_policy

class inspection_default

inspect pptp

Allow access to DMZ or other remote Vlan over VPN tunnel on Cisco ASA 8.4

I recently needed to provide internal access to a DMZ Vlan at one of my remote sites over a VPN tunnel. The VPN tunnel was provided by 2 Cisco ASA 5505 firewalls both running ASA software versions more recent than 8.4. The LAN subnets in this example can be defined as follows:

Main Office Subnet:     10.0.10.0/24

Remote Office Subnet:     10.0.20.0/24

Remote Office DMZ Subnet:     192.168.20.0/24

This article assumes that you already have the site to site VPN tunnel set up between the main office (10.0.10.0/24) subnet and the remote office (10.0.20.0/24) subnet, and that you have already created a network object for your main office subnet called main-office-lan, and for your remote office subnet called remote-office-lan on both ASAs. It also assumes that your DMZ interface on the remote ASA is called ‘dmz‘, and that you have an ACL defining interesting VPN traffic called main-remote-vpn on both ASAs.

Firstly create a network object for the remote office DMZ on both the main office and remote office ASAs. In configuration mode add the following two commands

object network remote-office-dmz

subnet 192.168.20.0 255.255.255.0

Next create a network object group for the 2 subnets at your remote site on both the main office and remote office ASAs

object-group network remote-office-networks
network-object object remote-office-lan
network-object object remote-office-dmz

Next, on the remote office ASA exempt traffic from the remote office DMZ subnet, to main office subnet from Network Address Translation (NAT) on the outside interface. i.e. traffic that will be travelling from the 192.168.20.0/24 to the 10.0.10.0/24 subnet over the VPN tunnel. In configuration mode add the following command:

nat (dmz,outside) source static remote-office-dmz remote-office-dmz destination static main-office-lan main-office-lan

Then on the remote office ASA change the ACL that defines interesting traffic for your site to site vpn tunnel (in this case called main-remote-vpn) to include the the dmz subnet, by using the network object group that you created earlier:

access-list main-remote-vpn extended permit ip object-group remote-office-networks object main-office-lan

Next you need to modify the configuration of the main office ASA to exempt traffic travelling over the VPN tunnel to the remote office DMZ from NAT, and also add the remote office subnet to the ACL that defines interesting traffic for your site to site VPN tunnel:

Modify the NAT rule on the main office ASA in config mode:

nat (inside,outside) source static main-office-lan main-office-lan destination static remote-office-networks remote-office-networks

Then modify the ACL that defines your site to site VPN traffic in config mode:

access-list main-remote-vpn extended permit ip object main-office-lan object-group remote-office-networks

Thats it, you should now be able to connect to hosts in the DMZ at you remote site over your site to site VPN connection. If you have multiple site to site VPNs from your main office network you may need to tweak this config , but the theory is the same.

PLEASE NOTE: This configuration will allow hosts in the DMZ at your remote site to connect to any hosts in your main office network! Clearly in most cases this will not be desirable, unless the additional remote Vlan is not a DMZ and performs some other function, which is not exposed directly to the Internet (which was the situation in my case). In any event you may wish to use VPN filters  to restrict traffic from the remote DMZ Vlan to your main office, or by disabling sysopt connection permit-vpn using the no sysopt connection permit-vpn command and applying ACLs to your outside interface. Excercise caution when applying either of these types of filtering to make sure you don’t restrict yourself from the site to site VPN tunnel.