We will use following topology to configure floating static route on Cisco ASA with Object Tracking.
Objective of this task:
- Configure floating static route with object tracking
- Configure Dynamic NAT via Primary and Backup Link
- Configure Static NAT with auto failover between Primary and Backup Link
Basic Configuration on ASA:
interface GigabitEthernet0
nameif outside
security-level 0
ip address 1.1.14.1 255.255.255.0
!
interface GigabitEthernet1
nameif outside-2
security-level 0
ip address 2.2.14.1 255.255.255.0
!
interface GigabitEthernet2
nameif inside
security-level 100
ip address 10.10.123.1 255.255.255.0
!
- Primary internet link IP subnet is 1.1.14.0/24 and ISP GW IP is 1.1.14.4.
- Backup internet link IP subnet is 2.2.14.0/24 and ISP GW IP is 2.2.14.4
- We will track reachability to IP address 4.4.4.4 via primary internet link to confirm if it is working fine.
# Configure static route to reach IP address 4.4.4.4 via primary internet link
route outside 4.4.4.4 255.255.255.255 1.1.14.4
# Create SLA Monitor session
sla monitor 101
type echo protocol ipIcmpEcho 4.4.4.4 interface outside
num-packets 5
frequency 10
sla monitor schedule 101 life forever start-time now
# Create track session
track 1 rtr 101 reachability
# Configure default route via primary internet link with tracking
route outside 0.0.0.0 0.0.0.0 1.1.14.4 1 track 1
# Configure default route via backup internet link with higher administrative distance (i.e, 200, default AD is 1 for static route)
route outside-2 0.0.0.0 0.0.0.0 2.2.14.4 200
# Configure Dynamic NAT rule for LAN users to access internet via primary or backup internet link
object network ANY
subnet 0.0.0.0 0.0.0.0
!
object network ANY-2
subnet 0.0.0.0 0.0.0.0
!
object network ANY
nat (inside,outside) dynamic interface
!
object network ANY-2
nat (inside,outside-2) dynamic interface
Verify default route and internet access
# Verify SLA Monitor configuration
ASA# show sla monitor configuration
SA Agent, Infrastructure Engine-II
Entry number: 101
Owner:
Tag:
Type of operation to perform: echo
Target address: 4.4.4.4
Interface: outside
Number of packets: 5
Request size (ARR data portion): 28
Operation timeout (milliseconds): 5000
Type Of Service parameters: 0x0
Verify data: No
Operation frequency (seconds): 10
Next Scheduled Start Time: Start Time already passed
Group Scheduled : FALSE
Life (seconds): Forever
Entry Ageout (seconds): never
Recurring (Starting Everyday): FALSE
Status of entry (SNMP RowStatus): Active
Enhanced History:
# Verify SLA Monitor operational status
ASA# show sla monitor operational-state
Entry number: 101
Modification time: 09:54:01.469 UTC Sat Aug 1 2015
Number of Octets Used by this Entry: 1480
Number of operations attempted: 34
Number of operations skipped: 0
Current seconds left in Life: Forever
Operational state of entry: Active
Last time this entry was reset: Never
Connection loss occurred: FALSE
Timeout occurred: FALSE
Over thresholds occurred: FALSE
Latest RTT (milliseconds): 8
Latest operation start time: 09:59:31.479 UTC Sat Aug 1 2015
Latest operation return code: OK
RTT Values:
RTTAvg: 8 RTTMin: 1 RTTMax: 20
NumOfRTT: 5 RTTSum: 42 RTTSum2: 602
# Verify track status
ASA# show track
Track 1
Response Time Reporter 101 reachability
Reachability is Up
2 changes, last change 00:05:45
Latest operation return code: OK
Latest RTT (millisecs) 4
Tracked by:
STATIC-IP-ROUTING 0
# Verify routing
ASA# show run route
route outside 0.0.0.0 0.0.0.0 1.1.14.4 1 track 1
route outside-2 0.0.0.0 0.0.0.0 2.2.14.4 200
route outside 4.4.4.4 255.255.255.255 1.1.14.4 1
ASA# sh route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is 1.1.14.4 to network 0.0.0.0
C 1.1.14.0 255.255.255.0 is directly connected, outside
C 2.2.14.0 255.255.255.0 is directly connected, outside-2
S 4.4.4.4 255.255.255.255 [1/0] via 1.1.14.4, outside
C 10.10.123.0 255.255.255.0 is directly connected, inside
S* 0.0.0.0 0.0.0.0 [1/0] via 1.1.14.4, outside
# Ping internet IP address 5.5.5.5 (It is configured on R5)
R2#ping 5.5.5.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/36/48 ms
# Verify NAT on ASA
ASA# show xlate
3 in use, 3 most used
Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
NAT from inside:10.10.123.3 to outside-2:2.2.14.103
flags s idle 0:09:24 timeout 0:00:00
NAT from inside:10.10.123.3 to outside:1.1.14.103
flags s idle 0:09:30 timeout 0:00:00
ICMP PAT from inside:10.10.123.2/2 to outside:1.1.14.1/35590 flags ri idle 0:00:28 timeout 0:00:30
ASA# show conn address 5.5.5.5
1 in use, 4 most used
ICMP outside 5.5.5.5:0 inside 10.10.123.2:3, idle 0:00:00, bytes 72
# Let's simulate primary internet link failure
# Shutdown int f0/0 on R4
R4#sh run int f0/0
Building configuration...
Current configuration : 92 bytes
!
interface FastEthernet0/0
ip address 1.1.14.4 255.255.255.0
speed 100
full-duplex
end
R4#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R4(config)#int f0/0
R4(config-if)#shut
R4(config-if)#
*Mar 1 00:13:08.571: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down
*Mar 1 00:13:09.571: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to down
R4(config-if)#
# Verify Track status on ASA
ASA# show track
Track 1
Response Time Reporter 101 reachability
Reachability is Down
3 changes, last change 00:00:31
Latest operation return code: Timeout
Tracked by:
STATIC-IP-ROUTING 0
# Verify Routing
ASA# show route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is 2.2.14.4 to network 0.0.0.0
C 1.1.14.0 255.255.255.0 is directly connected, outside
C 2.2.14.0 255.255.255.0 is directly connected, outside-2
S 4.4.4.4 255.255.255.255 [1/0] via 1.1.14.4, outside
C 10.10.123.0 255.255.255.0 is directly connected, inside
S* 0.0.0.0 0.0.0.0 [200/0] via 2.2.14.4, outside-2
# As you see in above output it has selected default route via backup ISP GW (2.2.14.4) now.
# Verify Internet access from LAN and NAT status on ASA. Now LAN subnet is dynamically NAT'ed to backup interface.
R2#ping 5.5.5.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/40/64 ms
ASA# show xlate
3 in use, 5 most used
Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
NAT from inside:10.10.123.3 to outside-2:2.2.14.103
flags s idle 0:18:18 timeout 0:00:00
NAT from inside:10.10.123.3 to outside:1.1.14.103
flags s idle 0:18:24 timeout 0:00:00
ICMP PAT from inside:10.10.123.2/6 to outside-2:2.2.14.1/5805 flags ri idle 0:00:39 timeout 0:00:30
ASA# show conn address 5.5.5.5
1 in use, 6 most used
ICMP outside-2 5.5.5.5:0 inside 10.10.123.2:6, idle 0:00:00, bytes 72
# Let's restore primary internet link
R4(config-if)#no shut
R4(config-if)#end
R4#
*Mar 1 00:22:12.595: %SYS-5-CONFIG_I: Configured from console by console
R4#
*Mar 1 00:22:13.935: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Mar 1 00:22:14.935: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
# Track status is UP now
ASA# show track
Track 1
Response Time Reporter 101 reachability
Reachability is Up
4 changes, last change 00:00:28
Latest operation return code: OK
Latest RTT (millisecs) 8
Tracked by:
STATIC-IP-ROUTING 0
# Verify Routing
ASA# show route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is 1.1.14.4 to network 0.0.0.0
C 1.1.14.0 255.255.255.0 is directly connected, outside
C 2.2.14.0 255.255.255.0 is directly connected, outside-2
S 4.4.4.4 255.255.255.255 [1/0] via 1.1.14.4, outside
C 10.10.123.0 255.255.255.0 is directly connected, inside
S* 0.0.0.0 0.0.0.0 [1/0] via 1.1.14.4, outside
So everything is working as expected, default route is used via primary link when track object IP 4.4.4.4 is reachable and when there is any issue with the primary link, i.e., IP 4.4.4.4 is not reachable via primary link, then this default route is removed and backup link become active. Also NAT translations are done based on the outgoing interface used by default route.
Now we have another requirement, We have a server (10.10.123.3) in LAN which need to be accessed from internet. First, we should have static NAT to be created for this server.
We will create two static NAT entries for this server. So that it can be accessed via either IP and internet link (Primary/Backup)
# Define Objects
object network SERVER-R3-PRIMARY
host 10.10.123.3
!
object network SERVER-R3-BACKUP
host 10.10.123.3
# Configure NAT Rules
object network SERVER-R3-PRIMARY
nat (inside,outside) static 1.1.14.103
!
object network SERVER-R3-BACKUP
nat (inside,outside-2) static 2.2.14.103
# Verify reachability from Internet (R5) to Server (Real IP: 10.10.123.3, Primary NAT: 1.1.14.103)
R5#ping 1.1.14.103
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.14.103, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 36/39/40 ms
# Verify NAT status on ASA
ASA# show xlate
2 in use, 5 most used
Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
NAT from inside:10.10.123.3 to outside-2:2.2.14.103
flags s idle 0:36:19 timeout 0:00:00
NAT from inside:10.10.123.3 to outside:1.1.14.103
flags s idle 0:00:11 timeout 0:00:00
ASA# show conn address 10.10.123.3
1 in use, 6 most used
ICMP outside 1.1.45.5:5 inside 10.10.123.3:0, idle 0:00:00, bytes 72
# Primary internet link is down now and default route is changed via backup ISP GW now
ASA# show track
Track 1
Response Time Reporter 101 reachability
Reachability is Down
5 changes, last change 00:00:01
Latest operation return code: Timeout
Tracked by:
STATIC-IP-ROUTING 0
ASA# show route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is 2.2.14.4 to network 0.0.0.0
C 1.1.14.0 255.255.255.0 is directly connected, outside
C 2.2.14.0 255.255.255.0 is directly connected, outside-2
S 4.4.4.4 255.255.255.255 [1/0] via 1.1.14.4, outside
C 10.10.123.0 255.255.255.0 is directly connected, inside
S* 0.0.0.0 0.0.0.0 [200/0] via 2.2.14.4, outside-2
# The Server is still reachable from internet via backup NAT IP
R5#ping 2.2.14.103
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.14.103, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 36/40/48 ms
# Verify NAT and connection status on ASA
ASA# sh xlate
2 in use, 5 most used
Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice
NAT from inside:10.10.123.3 to outside-2:2.2.14.103
flags s idle 0:00:00 timeout 0:00:00
NAT from inside:10.10.123.3 to outside:1.1.14.103
flags s idle 0:04:03 timeout 0:00:00
ASA# show conn address 10.10.123.3
1 in use, 6 most used
ICMP outside-2 1.1.45.5:10 inside 10.10.123.3:0, idle 0:00:00, bytes 72
Good Luck! 🙂
