Forwarding services through a secondary ISP

In this post I'm going to show how to implement a policy to forward some specific service through a secondary ISP. A dual-ISP scenario was described in my post about redundancy.



The following command lines are required to forward SMTP traffic through the ISP2:

route outside 0.0.0.0 0.0.0.0 192.168.0.254 1
route out-backup 0.0.0.0 0.0.0.0 172.16.0.254 2
nat (inside) 1 0.0.0.0 0.0.0.0
global (outside) 1 interface
global (out-backup) 1 interface
static (out-backup,inside) tcp 0.0.0.0 smtp 0.0.0.0 smtp netmask 0.0.0.0
 
The static statement is a destination NAT (outside NAT) and forces any SMTP traffic to be forwarded through the secondary ISP, even with the default route pointing to the ISP1 gateway. The default route with a higher administrative distance is necessary to route the outbound traffic and for the reverse traffic to be accepted via out-backup. If this route is not implemented, the following error happens:
 
Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: out-backup
output-status: up
output-line-status: up

Action: drop
Drop-reason: (no-adjacency) No valid adjacency
 
I have ran two traffic simulations to demonstrate how the firewall would handle HTTP and SMTP traffic for the same source and destination.

HTTP traffic simulation:
 
asa# packet-tracer input inside tcp 192.168.100.25 80 172.31.0.100 80

Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         outside

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit ip any any
Additional Information:

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
  match ip inside any outside any
    dynamic translation to pool 1 (192.168.0.1 [Interface PAT])
    translate_hits = 8, untranslate_hits = 0
Additional Information:
Dynamic translate 192.168.100.25/80 to 192.168.0.1/405 using netmask 255.255.255.255

Phase: 6
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
  match ip inside any outside any
    dynamic translation to pool 1 (192.168.0.1 [Interface PAT])
    translate_hits = 8, untranslate_hits = 0
Additional Information:

Phase: 7
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 23, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up

Action: allow


SMTP traffic simulation:

asa# packet-tracer input inside tcp 192.168.100.25 25 172.31.0.100 25

Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 2
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
static (out-backup,inside) tcp 0.0.0.0 smtp 0.0.0.0 smtp netmask 0.0.0.0
  match tcp out-backup any eq 25 inside any
    static translation to 0.0.0.0/25
    translate_hits = 0, untranslate_hits = 2
Additional Information:
NAT divert to egress interface out-backup
Untranslate 0.0.0.0/25 to 0.0.0.0/25 using netmask 0.0.0.0

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit ip any any
Additional Information:

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: INSPECT
Subtype: inspect-smtp
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
  match ip inside any out-backup any
    dynamic translation to pool 1 (172.16.0.1 [Interface PAT])
    translate_hits = 8, untranslate_hits = 0
Additional Information:
Dynamic translate 192.168.100.25/25 to 172.16.0.1/216 using netmask 255.255.255.255

Phase: 7
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
  match ip inside any outside any
    dynamic translation to pool 1 (192.168.0.1 [Interface PAT])
    translate_hits = 8, untranslate_hits = 0
Additional Information:

Phase: 8
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
static (out-backup,inside) tcp 0.0.0.0 smtp 0.0.0.0 smtp netmask 0.0.0.0
  match tcp out-backup any eq 25 inside any
    static translation to 0.0.0.0/25
    translate_hits = 0, untranslate_hits = 2
Additional Information:

Phase: 9
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
static (out-backup,inside) tcp 0.0.0.0 smtp 0.0.0.0 smtp netmask 0.0.0.0
  match tcp out-backup any eq 25 inside any
    static translation to 0.0.0.0/25
    translate_hits = 0, untranslate_hits = 2
Additional Information:

Phase: 10
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 11
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 24, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: out-backup
output-status: up
output-line-status: up

Action: allow


asa# show conn
2 in use, 2 most used
TCP out-backup 172.31.0.100:25 inside 192.168.100.25:25, idle 0:00:01, bytes 0, flags saA
TCP outside 172.31.0.100:80 inside 192.168.100.25:80, idle 0:00:04, bytes 0, flags saA


asa(config)# end
asa# wr mem