2 ISP, Router 1, 2 servers.

Forgive any ignorance in the matter. I have an ASA 5515 - x on my place of work, and we've just added a second service provider to one of the interfaces. We have two servers within our network and we want each server to use one of the internet connections that the ASA is connected. Is there a way I can put a server to send all of its contents on a pipe and the other server through another, without each interfere with each other. Any help would be appreciated. Thanks in advance.

Hello

I didn't try the below before but I guess you can.

Try the config below:

Example 1

gi0/1 interface

nameif ISP_1

security-level 0

address IP 1.1.1.1 255.255.255.252 (replace with your real ip address)

gi0/2 interface

nameif ISP_2

security-level 0

2.2.2.1 IP address 255.255.255.252 (replace with your real ip address)

gi0/3 interface

nameif inside

security-level 100

IP 192.168.1.1 255.255.255.0

network of the server_1 object

host 192.168.1.10

dynamic interface of NAT (inside ISP_1)

network of the LAN_TO_INTERNET object

subnet 192.168.1.0 255.255.255.0-online Note this server 2 will decrease as well as your home address

dynamic interface of NAT (inside ISP_2)

Example 2 (Server resides on DMZ) Public static PAT will be used

gi0/1 interface

nameif ISP_1

security-level 0

address IP 1.1.1.1 255.255.255.252 (replace with your real ip address)

gi0/2 interface

nameif ISP_2

security-level 0

2.2.2.1 IP address 255.255.255.252 (replace with your real ip address)

gi0/3 interface

nameif inside

security-level 100

IP 192.168.1.1 255.255.255.0

gi0/4 interface

nameif DMZ

security-level 100

address 192.168.20.1 255.255.255.0

network of the server_1 object

host 192.168.20.10

NAT (inside ISP_1) interface static tcp 80 80 service (this will allow what anyone from and to port 80)

network of the server_1 object

Home 192.168.20.20

NAT (inside ISP_2) interface static service tcp 80 80

see http://www.tunnelsup.com/nat-for-cisco-asas-version-8-3 for more examples.

HTH.

Kind regards

Terence

Tags: Cisco Security

Similar Questions

  • Should I fill the ISP router or TimeCapsule airport?

    Hello

    I hope that you will be able to provide me with some clarification on this subject: I recently bought a TimeCapsule airport that I intend to use for the implementation of a personal home network + network comments + backups etc. used in the family.

    Navigation through the Q & A on this (and other) support forum, I came to the conclusion that I can't use the airport as a router and at the same time use the router in the router/modem provided by my ISP. What I would like your help with is to understand what are the advantages and disadvantages of fill the ISP modem/router and airport, respectively.

    I understand now there might be an advantage to use the airport as the router because it's a powerful piece of equipment, but it might be a bad idea wise security visible directly from the Internet?

    Thank you for your support!

    If the ISP router is your main router, then the time Capsule would establish to a network bridge by selecting the join an existing network in the Airport utility. If the ISP router is a distinct feature of the cable modem, then remove it and use only the time Capsule as the router.

  • Communication from router to router via an ISP router

    Nice day

    I have a Setup at home, with that I would like to help.

    I have two routers in my house. One in the living room and the bedroom. The routers are connected to the router of my ISP.

    I would like to communicate between my two routers for the purpose of sharing SMB between my NAS and the NUC Intel running kodi. I am not able to routers link the two and am stuck with the ISP router. If I filled two routers I can share, but I prefer to do (if possible) not in bridge mode. Is it possible to get both routers to talk with each other? I'm a little lost here

    I put the 1900ACS in the lounge to have:

    IP: 192.168.1.1

    LAN DHCP: 192.168.1.2 to 192.168.1.50

    And the EA6400 in the bedroom:

    IP: 192.168.1.51

    LAN DHCP: 192.168.1.52 to 192.168.1.100

    Drawing enclosed with the installation program:

    http://i.imgur.com/WoJ8nW7.PNG

    Hi, @ckZA. Because the router is a NAT firewall, the installation type you want is not possible. The router will block incoming pings outside its own network.

    You rather connect the EA6400 to the WRT1900ACS and the EA6400 value clipping that both computers are connected to the same DHCP. They should be able to discover each other with this configuration.

    I hope this helps.

  • L2l VPN between ASA with the IP address public and CISCO2911 behind the ISP router with port forwarding

    Hi all

    My apologies if this is a trivial question, but I spent considerable time trying to search and had no luck.

    I encountered a problem trying to set up a temporary L2L VPN from a Subscriber with CISCO2911 sitting behind the router of the ISP of an ASA. ISP has informed that I can't ignore their device and complete the circuit Internet on the Cisco for a reason, so I'm stuck with it. The Setup is:

    company 10.1.17.1 - y.y.y.y - router Internet - z.z.z.z - ISP - LAN - 10.x.x.2 - XXX1 - ASA - 10.1.17.2 - CISCO2911 - 10.1.15.1 LAN

    where 10.x.x.x is a corporate LAN Beach private network, y.y.y.y is a public ip address assigned to the external interface of the ASA and the z.z.z.z is the public IP address of the ISP router.

    I have forwarded ports 500, 4500 and ESP on the ISP router for 10.1.17.2. The 2911 config attached below, what I can't understand is what peer IP address to configure on the SAA, because if I use z.z.z.z it will be a cause of incompatibility of identity 2911 identifies himself as 10.1.17.2...

    ! ^ ^ ^ ISAKMP (Phase 1) ^ ^ ^!
    crypto ISAKMP policy 5
    BA 3des
    md5 hash
    preshared authentication
    Group 2
    lifetime 28800
    isakmp encryption key * address no.-xauth y.y.y.y

    ! ^ ^ ^ IPSEC (Phase 2) ^ ^ ^!
    crymap extended IP access list
    IP 10.1.15.0 allow 0.0.0.255 10.0.0.0 0.255.255.255
    Crypto ipsec transform-set ESP-3DES-SHA 3rd-esp esp-sha-hmac
    card crypto 1 TUNNEL VPN ipsec-isakmp
    defined peer y.y.y.y
    game of transformation-ESP-3DES-SHA
    match the address crymap

    Gi0/2 interface
    card crypto VPN TUNNEL

    Hello

    debug output, it seems he's going on IPSEC States at the tunnel of final bud QM_IDLE's.

    What I noticed in your configuration of ASA box, it's that you're usig PFS but not on 2911 router.

    So I suggest:

    no card crypto OUTSIDE_map 4 don't set pfs <-- this="" will="" disable="" pfs="" on="" asa="">

    Then try tunnel initiate.

    Kind regards

    Jan

  • L3 PC 6248 ISP routing switch

    And I was wondering if someone could help me please?
    We have recently sign up for FPL FiberNet Direct Internet Access (DIA), and they give us a point to point IP 30 for connection between our fiber-copper Transceiver and the NOC and also gave us a block of 28 public IPs we road to the 30 default of IPs to our local network gateway and servers.
    We have a few 6248 PC laying around and were told to use one of them to get the job of the internet!
    I did research on how to make this work between manual the device reference guide and other threads on the support forum, I came up with the following configuration and I was wondering anyone could look at it and let me know if it wise and might work or if I'm missing something, or maybe do it in a completely different way :

    Create a VLAN 100 to 28 address block

    Console #configurer
    console (config) #vlan database
    Console (config - vlan) #vlan 100
    Console (config - vlan) #exit

    Configure the VLAN routing for the VLAN and assign an IP address

    Console #configurer
    Console (config) #interface vlan 100
    Console (config-if-vlan100) #routing

    Console (config-if-vlan100) #ip address 68.168.25.33 255.255.255.240

    Console (config-if-vlan100) #exit

    Console (config) #ip Routing

    Associate a subnet IP with a VLAN

    It shows how to configure the switch so that all hosts with IP addresses in the network of 68.168.25.32/28 are members of the VLAN 100.

    Console #configurer
    console (config) #vlan database

    subnet of console (config - vlan) #vlan association 68.168.25.32 255.255.255.240 100

    Create VLAN 200 out of the 30 internet

    Console #configurer
    console (config) #vlan database
    Console (config - vlan) #vlan 200
    Console (config - vlan) #exit

    Configure the VLAN routing for the VLAN and assign an IP address

    Console #configurer
    Console (config) #interface vlan 200

    Console (config-if-vlan200) #ip address 198.150.3.110 255.255.255.252

    Console (Config-if-vlan200) # name internet vlan
    Console (config-if-vlan200) #routing

    Console (config-if-vlan200) #exit

    Assign a Port to VLAN200

    Console (config) #interface ethernet 1/g1

    access mode console (config-if-1/g1) #switchport

    Console (config-if-1/g1) #switchport access vlan 200

    Console (config-if-1/g1) #exit

    road to console (config) #ip 0.0.0.0 0.0.0.0 198.150.3.109

    OK, we finally got I work, my mistake was that I had together 1/g1 port for access mode and it was supposed to be in general Mode so I issued the following command so my VLAN would receive traffic labeled the ISP VLAN 200 they gave me with:

    interface ethernet 1/g1

    switchport mode general

    switchport General pvid 200

    switchport general allowed vlan add 200 tag

    I also was on the phone with them to make sure that I got everything we need on the VIRTUAL LAN, they gave me and to make sure we could ping back, they end up doing some changes at their end for all operate as it should, it's the running configuration see the final :

    ! Current configuration:

    ! Description of the system "PowerConnect 6248, 3.3.7.2, VxWorks 6.5.

    ! 3.3.7.2 system software version

    ! Passage mode is configured as disabled

    !

    Configure

    database of VLAN

    VLAN 100 200

    VLAN 100 1 routing

    VLAN 200 2 routing

    output

    battery

    1 2 Member

    output

    IP 192.168.1.1 255.255.255.0

    by default-gateway IP 192.168.1.254

    no console logging

    IP routing

    IP route 0.0.0.0 0.0.0.0 198.150.3.109

    interface vlan 100

    Routing

    IP 68.168.25.33 255.255.255.240

    output

    interface vlan 200

    name ' internet - vlan ".

    Routing

    IP 198.150.3.110 255.255.255.252

    output

    user name 'admin' password password

    !

    interface ethernet 1/g1

    switchport mode general

    switchport General pvid 200

    switchport general allowed vlan add 200 tag

    output

    !

    interface ethernet 1/g2

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g3

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g4

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g5

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g6

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g7

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g8

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g9

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g10

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g11

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g12

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g13

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g14

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g15

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g16

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g17

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g18

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g19

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g20

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g21

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g22

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g23

    GVRP enable

    switchport access vlan 100

    output

    !

    interface ethernet 1/g24

    GVRP enable

    switchport access vlan 100

  • How can I set Up Airport Express with an existing router/modem from the ISP

    I have a wireless modem/router ISP and I want to get the ability to use Air Print using a non-Airprint but the USB printer. I suggest you to connect the printer to the Airport Express A1392 Epson) via a USB port to enable the AirPrint features.  However, I guess the Airport Express must be an ethernet to the modem/router ISP connection and then use the Epxress airport more convenient than my wireless router.

    Issues related to the:

    1. do I need to turn off the function the ISP router's wireless when I plugged as stated above? So I wait.

    2. as the Airport Express only has one ethernet port I assume that I can connect my other ethernet connections using a hub 4 ports connected to the Airport Express Terminal.  It will be always possible to use other ports ethernet on the modem/router ISP as well?

    Doug

    I have a wireless modem/router ISP and I want to get the ability to use Air Print using a non-Airprint but the USB printer.

    You may have received incorrect information, because a non-AirPrint on the USB port on an AirPort Express Terminal... or any other router from Apple also printer... do not make the AirPrint-compatible printer.

    You want to continue nevertheless to check that this is true?

    The AirPort Express can connect to the network wireless router using a wireless connection... or... it can connect to one of the router's Ethernet ports using a wired Ethernet connection.

    Wired connections are always preferable wireless if possible for your Express.  Turn off the wireless router is not necessary if you want to connect to the Express using an Ethernet connection.

  • Router (wrt300n) acting as a forwarder/server/resolver dns, why/how?

    Hello

    Modem speedtouch 516 defined as = bridge

    Router = linksys wrt300n, made the pppoe dsl connection

    OS = vista 64-bit, also have test with computer laptop linux clean/white

    By making a few landmarks on the dns servers, a tested program 192.168.1.1.

    This made me nervous and start questioning why is this and is there a problem of problem/vulnerability/security/etc.

    192.168.1.1 is my default gateway so my router.

    Do a "nslookup - 192.168.1.1' (temporary use this specific ip address as a server) and then by typing a url returns a response.

    According to tech-live chat, this router does not have dns forwarding nor made any linksys router.

    If the router doesn't do not dns forwarding how is, I get dns results when you do a nslookup or change the dns at 192.168.1.1?

    On some tests (dnsbench of grc.com) 192.168.1.1 is faster than dns servers that my ISP router forwards/gives. If the router was dns, it would normally use the dns ips he has in his list given to him by my ISP, right? So 192.168.1.1 and ISP - dns speed should be the same speed, no?

    Am I lack/misunderstanding something?

    Help. Thank you

    1. If the beneficiary address DNS server to the client is 192.168.1.1 router must do DNS redirection. Otherwise the customer could not resolve host names. There is no other way to do this if the client knows nothing but 192.168.1.1.

    2. the router uses the servers DNS ISP as shown on the router status page. Here are the only addresses that the router knows.

    3. the router is probably a DNS caching, also, so the router's responses are faster if the result is in the cache.

    4. as it is a redirector is also vulnerable or not vulnerable to the poisonings and other things your ISP DNS server.

    5. you can not handle. This is a redirector maybe with a bit of cache memory.

    6. If you set like him your other DNS server on your customers or in the DHCP server.

  • Research by ASA &amp; ISP address space

    Hi all

    Maybe a stupid question. One of my clients planning on creating RDP access to some servers sitting on 'Inside' of ASA5510. Customer asked pulic ISP 24 address space and had a 1.1.1.0/24 (ips changed). In addition, ISP customer provided with ASA ouside I / f IP: 2.2.2.2/30 and default gateway for ASA (modem Internet service providers) such as 2.2.2.1/30.

    So what is the best way to use the ISP assigned public IPs to provide RDP access to servers on the inside... ? Can I assign 1.1.1.1/24 to ASA inside and can create a "No. NAT' to access internet and RDP.

    Or I thought initially to have NAT with ip pvt in-house system (wasn't aware of public ip address space required). So is it possible using the same ip address space pvt and assigned/24 ip addresses to create Internet/RDP access?

    Help for config links is appreciated.

    Thank you inadvance

    MS

    "I thought initially to have NAT with ip pvt in-house system (wasn't aware of public ip address space request)." Is it so possible using the same pvt ip address space and assigned/24 ip addresses to create Internet/RDP

    access? "

    Upsolutely possible and the best to do as you have thought about it.

    If I understand correctly: Please correct me otherwise!

    1. you have ASA5510, outside of the interface with the IP public 2.2.2.2/30

    2 - ISP router with IP 2.2.2.1/30

    Gives 3 - Customer ISP 254 public IP addresses using client on another beach 1.1.1.0/24

    Well, you can do the following if you do not have inside the configured IP interface.

    1 - ASA5510 inside can be any subnet ip to any of the reserved private beaches. For your inside interface you can use one of the below private beaches.

    i 10.0.0.0 through 10.255.255.255

    II - 172.16.0.0 to 172.31.255.255

    III - 192.168.0.0 to 192.168.255.255

    Assume that you have inside the 172.16.1.1/24 interface

    If you have:

    ASA5510 outside interface IP: 2.2.2.2/30

    ASA5510 inside the interface IP: 172.16.1.1/24

    for your ISP services new public IP range just create your one-to-one NAT in ASA5510

    translations by using the new IP address of the ISP. Note that the ISP should route the new public IP address space to your ASA5510 outside interface, Im sure they know that.

    As said, just create your static nat using the new public IP address, you can also create

    If necessary global nat pools.

    for example RDP access from outside with the public IP 1.1.1.100 coordinated to 172.16.1.50 PC inside the host

    static (inside, outside) 1.1.1.100 172.16.1.50 netmask 255.255.255.0 0 0

    outside_access_in list access permit tcp any host 1.1.1.100 eq 3389

    Access-group outside_access_in in interface outside

    for example, creating additional pools of global variables using the new IP PAT range.

    Global 1.1.1.50 - 1.1.1.74 2 (outdoor)

    Global (outside) 2 1.1.1.75

    Rgds

    Jorge

  • On my home ISP, icloud pictures don't download or download.

    On most internet-connected wifi networks (work and with friends) pictures new download to iCloud all my devices (Macbook, iphone 6, iPad 2) without problem. However, I have internet installed in a new House and something prevents pictures by download. On all devices, it just says: "send the 7 Items" without a time indicator and show how much MB transferred. I tried a new Zyxl (from the ISP) router and an older D-link router. My conclusion is that something on the ISP blocking / prevents it. I think that icloud backup (iphone) might also have a problem - it seems stuck on the beginning and estimate the remaining time saying. He said: he has not completed a backup since the day wherever we moved here. I can't find another thing that does not work; Viber is fine, dropbox is great, google reader is fine, find my iphone is fine. When I ask the ISP, they say that they do not prevent anything. But maybe if I know what to ask more specifically so I can work on if it is the problem or not. No one knows what to look for? It's one thing to firewall on the network of the ISP? Or a specific port? Or a protocol? Is there another application, problem I can check who uses similar methods to iCloud photos which may not work to help others identify the problem?

    Contact your ISP and ask them to correct the problem.

  • I already have a wireless router...

    I already have a router provided by my ISP. Can I use my Airport Time Capsule to act as an external hard drive wireless and run time capsule without changing my current router?

    JB

    You can use the time Capsule... IF... the time Capsule will be connected to the ISP router using a connection permanent, fixed Ethernet cable. The time Capsule cannot connect wirelessly to the wireless ISP.

    After you have connected to the ISP router using an Ethernet connection time Capsule... If you ask about backup on the Capsule of time using Time Machine on your Mac, you will need to backup using Time Capsule wireless... If you want the process to be officially supported by Apple.

    You might be able to save on time using the ISP wireless Capsule... but if you have backup in this way problems... There will be no help from Apple.

  • R6400 router Internet intermittent issues

    Hi all

    Got Netgear R6400 and for help from behind the ISP supplied Modem/Router, even though I turned off the Wifi of the provided ISP router functionality. When you are connected normally awhile, I'm not able to access INternet Wifi was shown to be connected.

    Also not able to ping to the IP address of the ISP router provided at the show, once she came back after reboot while other times it solve just after a few minutes. Router watch new Firmware is available, but I don't know if he can really solve the problem or aggravate the situation. While I connected the NAS (QNAP) with her and she is very stable and better speed thn my old DSL68U from ASUS.

    The ISP modem /router must be placed in bridge mode OR change the r6400 for AP Mode

    Page 128

    http://www.downloads.NETGEAR.com/files/GDC/R6400/R6400_UM_07Aug2015.PDF

  • Sites Web r7000 redirect router

    Hello, since yesterday, I had a strange problem with all Web sites, I've tried to go to redirect me back to my login page of the router.
    If I tried to ping of all Web sites by name, that I would get

    Ping www.google.co.uk [192.168.1.1] with 32 bytes of data.
    Reply from 192.168.1.1: bytes = 32 time = 3ms TTL = 64
    Reply from 192.168.1.1: bytes = 32 time = 2ms TTL = 64
    Reply from 192.168.1.1: bytes = 32 time = 2ms TTL = 64
    Reply from 192.168.1.1: bytes = 32 time = 2ms TTL = 64

    I completely reset my router and brand new to the default configuration and the same problem is still there.
    Plugged into my router by default ISP that I have ever used and the value that up and theres no problem.
    Side note, my ISP router does not require the need to use a fiber modem, I think maybe the question could be the modem and not the router.

    No idea why I didn't try this earlier, pressed the factory key which solved the problems of reset >. >

  • Want to block access to others of my wireless router

    people keep connecting our wireless connection from outside our House and doing terrible research and we want to prevent this.

    Hi Alison,.

    Wireless routers can be set with security (and then you put the same level of security and the key on your computers, and only you can access it).

    Go to start / all programs / accessories / right-click on command prompt, and click Run as administrator.  Then type IPCONFIG/all and click Enter (exactly as written with the space).  It should show you a number of things, including what is called the default gateway for your wireless connection.  This is most likely your router and probably something like 192.168.0.1 or something similar.

    Now, open IE (or your browser) and in the address bar, type the same number.  This should connect to the router.   He may request a user name and password.  If you don't, contact your ISP or router manufacturer to be reset or get help to find or to find out what they use as the default generic values on this brand and model (if reset, no matter what they say, change them for something unique that you'll remember because many people know those generic used by companies and can easily get past that thanks to) them and we'll close them - they'll suggest against it because if you forget them, you watered - and it's true, so just remember them).  Once again, you will need to go to security and configure security settings appropriate for your system (and possibly make a few other changes as well).  You will probably need assistance of the ISP or router manufacturer to select the most appropriate for your system and network and ISP router.  For example, I couldn't use the best Type of security because it was not compatible, but was able to use the best following which is fine - but who would never have known had not walked me through the process.

    Once done, go to your devices and computers and change the wireless settings to match those of the router.  You will probably have set up a security Type and the Type of encryption and a network security key (which is basically a password).  It is difficult to guide you without knowing your OS, but for mine using Vista I'm going on the network and sharing Center in Control Panel and click on 'manage wireless networks '.  Then I double click on my wireless network connection and click on the Security tab and it present options for these same three elements.  I input what I set up on the router, save the settings and reboot.  When I'm back, I can now connect to the network, and the wireless connection is secure (and if you see the wireless network page, it will say now secure and if you go to "Connect to a network" the options presented will also show it is attached.)  That's all and you have completed and now you are sure.

    I hope this helps.

    Good luck!

  • Cannot ping router

    I can't ping my router or other device on my network, and can't connect to the internet.
    I can ping myself or the local host.  I use a wireless connection. The wireless connection icon shows the status connected with a staff of excellent.
    I ran the Diagnostics network and everything he told me that if he failed because he cannot ping the router and DNS servers.
    I don't know why.  Can someone tell what to do next?

    Solved.
    If you missed all info, all you had to do was ask.  I don't remember do not provide that whatever it is asked.
    In any case, I tried to connect an ethernet cable from the vrouter in it mobile and connected to the network immediately ITI.
    I don't know why the diagnosis doesn't have to indicate the wireless card has been a problem.  It shows that its correct operation.  Now, I even once to download and reinmstall Norton.  I hope their support will provide me with the correct key.  I'm happy I don't have to wast of countless hours to redo my network addressing scheme works.
    Thanks for your time.

  • EA3500 seems to block a web site - my ISP Webmail

    I have an EA3500 which was great.  All of a sudden it isn't allowing me to access Webmail while on the WIFI.  I can an electrician in the ISP router and get to the page very well, when I try wireless it cannot access the page.  It worked in the past - and I'm not having problems with any other page.

    All the ideas!  I tried to start with the configuration but also remove all the 3500 safety - no luck.

    Thank you!

    You will need to contact your support Webmail to get unlocked.

Maybe you are looking for