PfSense and ASA 5505

cisco-asapfsense

I've got an ASA-5505 (v8.4) in production that handles VPN connections and some public web servers. I wanted to offload user HTTP traffic onto a second Internet connection so I put together a pfSense (2.0.2) appliance and set the default route on the ASA to the pfSense which worked for routing outbound traffic but I'm sure you guessed that it broke incoming traffic on the public IPs.

This setup is just a little over my head so I'm looking for some direction on the proper configuration to do PBR for the two WANs but keep the ASA in the mix to handle the VPN and public IP servers.

Here's an overly simplified diagram of my config, I hope it makes sense:

ISP1 --- ISP1_IP1:WAN --\
                         pfSense --- LAN/172.16.0.1 --------|
ISP2 --- ISP2_IP1:OPT1 -/                                   |
 |                                                outside2/172.16.0.2
 |                                                          |
 |------ ISP2_IP2:static nat(inside,outside):10.0.0.10 -- ASA-5505 -- inside/10.0.0.0
 |                                                          |
 |------ ISP2_IP3:static nat(inside,outside):10.0.0.20 -----|
 |                                                          |
 |------ ISP2_IP4:VPN (outside IP) -------------------------|

On the ASA I set something like this:

route outside2 0 0 172.16.0.1
nat (inside,outside2) source dynamic subnet_inside interface

Best Answer

Hmm in your current setup it looks like you are going to have to double-NAT your inbound traffic if you want inbound access to work, and your VPN traffic may no longer work at all. You'd have to have the pfsense listen on the public IPs and from the public IP, you'll have to NAT on the pfsense to the 172.16.0.0 subnet that is between the pfsense and the ASA, and NAT the 172.16.0.0 subnet on the ASA to the true inside subnet of 10.0.0.0... Fairly complicated since you'll have to maintain 2 separate NAT translations and ACLs on 2 separate firewalls, but is pretty secure too. It would look like this:

|.out........pfsense..........in.|.out........ASA.............in.|
public IP > NAT to 172.16.0.0 IP > 172.16.0.0 IP > NAT to 10.0.0.0

I implemented something similar with a pfsense and a PIX without the double-NAT'ing a few years ago with the PIX already handling everything before I implemented the pfsense. Essentially what I did was put both the PIX (VPN, public IPs, etc...) and the pfsense on the same outside subnet that the PIX was currently hooked up to (public subnet). Then I set the clients to use the pfsense's inside IP as a gateway instead of the PIX's inside IP. All their outbound web traffic routed through the pfsense.

Then I migrated the outside IPs & NATs for inbound traffic to be handled by the pfsense instead of the PIX, switching the gateway of the NAT'ed internal server to the pfsense's inside IP as I went along. I never did get VPN working with the pfsense... but it sounds like this should accomplish your goal. The only downside (or maybe upside) was the internal clients and servers were inaccessible through the VPN on the PIX. Also this becomes more complicated if you have multiple internal subnets to route between internally.

If you are just looking to hook up to multiple ISPs for outbound web traffic, you might want to look at a Dual-WAN router instead of a full-blown firewall like the pfsense.

Related Topic