Step 1

Configure the inside interface (Gi0/1) of the device to be assigned to Sales virtual router:

1. Choose Devices > Device Management > Interfaces.

2. Edit the Gi0/1 interface:

   • Name—For this example, VR-Sales.

   • Select the Enabled checkbox.

   • In IPV4, for IP Type, choose Use Static IP.

   • IP Address—Enter 10.30.0.1/24.

3. Click Ok.

4. Click Save.

Step 2

Configure the inside interface (Gi0/2) of the device to be assigned to Warehouse virtual router:

1. Choose Devices > Device Management > Interfaces.

2. Edit the Gi0/2 interface:

   • Name—For this example, VR-Warehouse.

   • Select the Enabled checkbox.

   • In IPV4, for IP Type, choose Use Static IP.

   • IP Address—Leave it blank. The system does not allow you to configure interfaces with same IP address (10.30.0.1/24), as you are yet to create user-defined virtual routers.

3. Click Ok.

4. Click Save.

Step 3

Create Sales and Warehouse virtual routers and assign their interfaces:

1. Choose Devices > Device Management, and edit the threat defense device.

2. Choose Routing > Manage Virtual Routers.

3. Click Add Virtual Router and create Sales.

4. Click Add Virtual Router and create Warehouse.

5. Select Sales from virtual router drop-down, in Virtual Router Properties, add VR-Sales as Selected Interface and save.

6. Select Warehouse from virtual router drop-down, in Virtual Router Properties, add VR-Warehouse as Selected Interface and save.

Step 4

Revisit the VR-Warehouse interface configuration:

1. Choose Devices > Device Management > Interfaces.

2. Click Edit against VR-Warehouse interface. Specify the IP Address as 10.30.0.1/24. The system now allows you to configure with same IP address of VR-Sales, because the interfaces are seperately assigned to two different virtual routers.

3. Click Ok.

4. Click Save.

Step 5

Create network objects for the warehouse server—10.50.0.0/24, and for the warehouse gateway— 10.40.0.2/30:

1. Choose Object > Object Management.

2. Choose Add Network > Add Object:

   • Name—For this example, Warehouse-Server.

   • Network—Click Network and enter 10.50.0.0/24.

3. Click Save.

4. Choose Add Network > Add Object:

   • Name—For this example, Warehouse-Gateway.

   • Network—Click Host and enter 10.40.0.2.

5. Click Save.

Step 6

Define the route leak in Sales that points to the VR-Warehouse interface:

1. Choose Devices > Device Management, and edit the threat defense device.

2. Choose Routing.

3. Choose Sales virtual router from the drop-down, and then click Static Route.

4. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select VR-Warehouse.

   • Network—Select the Warehouse-Server object.

   • Gateway—Leave it blank. When leaking a route into another virtual router, do not select the gateway.

     

5. Click Ok.

6. Click Save.

Step 7

In the Warehouse virtual router, define the route that points to the Warehouse Router 2 gateway:

1. Choose Warehouse virtual router from the drop-down, and then click Static Route.

2. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select VR-Warehouse.

   • Network—Select the Warehouse-Server object.

   • Gateway—Select the Warehouse-Gateway object.

     

3. Click Ok.

4. Click Save.

Step 8

Configure access control rule that allows access to the warehouse server. For creating the access control rule, you need to create security zones. Use Object > Object Management > Interface. Choose Add > Security Zone and create security zones for VR-Sales and VR-Warehouse; for Warehouse-Server network object, create a Warehouse-Server interface group (Choose Add > Interface Group).

Step 9

Choose Policies > Access Control and configure an access control rule to allow traffic from the source interfaces in the Sales virtual router to the destination interfaces in the Warehouse virtual router for the destination Warehouse-Server network object.

For example, if the interfaces in Sales are in the Sales-Zone security zone, and those in Warehouse are in the Warehouse-Zone security zone, the access control rule would look similar to the following:

Step 1

Configure the inside interface of the device for VR1:

1. Choose Devices > Device Management > Interfaces.

2. Edit the interfaces that you want to assign to VR1:

   • Name—For this example, vr1-inside.

   • Select the Enabled checkbox.

   • In IPV4, for IP Type, choose Use Static IP.

   • IP Address—Enter 192.168.1.1/24.

3. Click Ok.

4. Click Save.

Step 2

Configure the inside interface of the device for VR2:

1. Choose Devices > Device Management > Interfaces.

2. Edit the interfaces that you want to assign to VR2:

   • Name—For this example, vr2-inside.

   • Select the Enabled checkbox.

   • In IPV4, for IP Type, choose Use Static IP.

   • IP Address—Leave it blank. The system does not allow you to configure interfaces with same IP address, as you are yet to create user-defined virtual routers.

3. Click Ok.

4. Click Save.

Step 3

Configure VR1 and the static default route leak to the outside interface:

1. Choose Devices > Device Management, and edit the threat defense device.

2. Choose Routing > Manage Virtual Routers. Click Add Virtual Router and create VR1.

3. For VR1, in Virtual Router Properties, assign vr1-inside and save.

4. Click Static Route.

5. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the outside interface of the global router.

   • Network—Select the any-ipv4 object. This network is the default route for any traffic that cannot be routed within VR1.

   • Gateway—Leave it blank. When leaking a route into another virtual router, do not provide a Gateway.

     

6. Click Ok.

7. Click Save.

Step 4

Configure VR2 and the static default route leak to the outside interface:

1. Choose Devices > Device Management, and edit the threat defense device.

2. Choose Routing > Manage Virtual Routers. Click Add Virtual Router and create VR2.

3. For VR2, in Virtual Router Properties, assign vr2-inside and save.

4. Click Static Route.

5. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the outside interface of the global router.

   • Network—Select the any-ipv4 object. This network is the default route for any traffic that cannot be routed within VR2.

   • Gateway—Leave it blank. When leaking a route into another virtual router, do not select the Gateway.

     

6. Click Ok.

7. Click Save.

Step 5

Configure IPv4 static default route, namely 172.16.1.2 on the outside interface of the global router:

1. Choose Devices > Device Management, and edit the threat defense device.

2. Choose Routing and edit global router properties.

3. Click Static Route.

4. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the outside interface of the global router.

   • Network—Select the any-ipv4 object. This will be the default route for any IPv4 traffic.

   • Gateway—If already created, select the host name from the drop-down. If the object is not yet created, click Add and define the host object for the IP address of the gateway at the other end of the network link on the outside interface, in this example, 172.16.1.2. After you create the object, select it in the Gateway field.

     

5. Click Ok.

6. Click Save.

Step 6

Revisit the vr2-inside interface configuration:

1. Choose Devices > Device Management > Interfaces.

2. Click Edit against vr2-inside interface. Specify the IP Address as 192.168.1.1/24. The system now allows you to configure with same IP address of vr1-inside, because the interfaces are separately assigned to two different virtual routers.

3. Click Ok.

4. Click Save.

Step 7

Create the NAT rule to PAT inside to outside traffic of VR1 to 10.100.10.1.

1. Choose Devices > NAT.

2. Click New Policy > Threat Defense NAT.

3. Enter InsideOutsideNATRule as the NAT policy name, and select the threat defense device. Click Save.

4. In InsideOutsideNATRule page, click Add Rule and define the following:

   • NAT Rule—Select Manual NAT Rule.

   • Type—Select Dynamic.

   • Insert—Above, if any dynamic NAT rule exists.

   • Click Enabled.

   • In Interface Objects, select vr1-interface object and click Add to Source (If the object is not available, create one in Object > Object Management > Interface), and select outside as Add to Destination.

   • In Translation, for Original Source, select any-ipv4. For Translated Source, click Add and define host object VR1-PAT-Pool with 10.100.10.1. Select VR1-PAT-Pool as shown in the figure below:

     

5. Click Ok.

6. Click Save.

Step 8

Add NAT rule to PAT inside to outside traffic of VR2 to 10.100.10.2.

1. Choose Devices > NAT.

2. Edit InsideOutsideNATRule to define the VR2 NAT rule:

   • NAT Rule—Select Manual NAT Rule.

   • Type—Select Dynamic.

   • Insert—Above, if any dynamic NAT rule exists.

   • Click Enabled.

   • In Interface Objects, select vr2-interface object and click Add to Source (If the object is not available, create one in Object > Object Management > Interface), and select outside as Add to Destination.

   • In Translation, for Original Source, select any-ipv4. For Translated Source, click Add and define host object VR2-PAT-Pool with 10.100.10.2. Select VR2-PAT-Pool as shown in the figure below:

     

3. Click Ok.

4. Click Save.

Step 9

To configure the access control policy that allows traffic from the vr1-inside and vr2-inside interfaces to the outside interface, you need to create security zones. Use Object > Object Management > Interface. Choose Add > Security Zone and create security zones for vr1-inside, vr2-inside, and outside interfaces.

Step 10

Choose Policies > Access Control and configure an access control rule to allow traffic from vr1-inside-zone and vr2- inside-zone to outside-zone.

Assuming that you create zones named after the interfaces, a basic rule that allows all traffic to flow to the Internet will look like the following. You can apply other parameters to this access control policy:

Step 1

Configure route leak from Global virtual router to the user-defined VR1:

1. Choose Devices > Device Management, and edit the threat defense device.

2. Click Routing. By default, the Global routing properties page appears.

3. Click Static Route.

4. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the VR1 inside interface.

   • Network—Select the VR1 virtual router network object. You can create one using the Add Object option.

   • Gateway—Leave it blank. When leaking a route into another virtual router, does not select the gateway.

     

   The route leak allows AnyConnect Client assigned IP addresses in the VPN pool to access the 192.168.1.0/24 network in the VR1 virtual router.

5. Click Ok.

Step 2

Configure the route leak from VR1 to the Global virtual router:

1. Choose Devices > Device Management, and edit the threat defense device.

2. Click Routing and from the drop-down, select VR1.

3. Click Static Route.

4. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the outside interface of the global router.

   • Network—Select the global virtual router network object.

   • Gateway—Leave it blank. When leaking a route into another virtual router, does not select the gateway.

     

   The configured static route allows endpoints on the 192.168.1.0/24 network (VR1) to initiate connections to AnyConnect Client assigned IP addresses in the VPN pool.

5. Click Ok.

Step 1

Configure route leak from the Global virtual router to the user-defined VR1:

1. Choose Devices > Device Management, and edit the threat defense device.

2. Click Routing. By default, the Global routing properties page appears.

3. Click Static Route.

4. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the VR1 inside interface.

   • Network—Select the VR1 virtual router network object. You can create one using the Add Object option.

   • Gateway—Leave it blank. When leaking a route into another virtual router, do not select the gateway.

     

   The route leak allows endpoints protected by the external (remote) end of the site-to-site VPN to access the 192.168.1.0/24 network in the VR1 virtual router.

5. Click Ok.

Step 2

Configure the route leak from VR1 to the Global virtual router:

1. Choose Devices > Device Management, and edit the threat defense device.

2. Click Routing and from the drop-down, select VR1.

3. Click Static Route.

4. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the outside interface of the global router.

   • Network—Select the global virtual router network object.

   • Gateway—Leave it blank. When leaking a route into another virtual router, do not select the gateway.

     

   This static route allows endpoints on the 192.168.1.0/24 network (VR1) to initiate connections that will traverse the site-to-site VPN tunnel. For this example, the remote endpoint that is protecting the 172.16.20.0/24 network.

5. Click Ok.

Step 3

Add the 192.168.1.0/24 network to the site-to-site VPN connection profile:

1. Choose Devices > VPN > Site To Site, and edit the VPN Topology.

2. In Endpoints, edit Node A endpoint.

3. In Edit Endpoint, in the Protected Networks field, click Add New Network Object.

4. Add the VR1 network object with 192.168.1.0 network:

   

5. Click Ok and save the configuration.

Step 1

Create the NAT rule to handle traffic from Host A to Host B. Choose Devices > NAT.

Step 2

Click New Policy > Threat Defense NAT.

Step 3

Enter a NAT policy name, and select the threat defense device. Click Save.

Step 4

In the NAT page, click Add Rule and define the following:

firepower(config-service-object-group)# show nat detail
Manual NAT Policies (Section 1)
1 (2001) to (3001) source static vrg-inside VRG-MAPPED-HOST destination static VRB-MAPPED-HOST vrb-inside
translate_hits = 0, untranslate_hits = 0
Source - Origin: 10.1.1.1/24, Translated: 20.1.1.1/24
Destination - Origin: 30.1.1.1/24, Translated: 10.1.1.1/24

Step 5

Click Ok.

Step 6

Click Save.

The NAT rule looks like this:

When you deploy the configuration, a warning message appears:

Step 1

Choose Devices > Device Management. Edit the required device.

Step 2

In Interfaces, choose Add Interfaces > Bridge Group Interface.

1. Enter the following details for BVI-G:

   • Name—For this example, BVI-G.

   • Bridge Group ID—For this example, 1.

   • Available Interface—Select the interfaces.

   • In IPV4, for IP Type, choose Use Static IP.

   • IP Address—Enter 10.10.10.5/24.

   

2. Click Ok.

3. Click Save.

1. Enter the following details for BVI-B:

   • Name—For this example, BVI-B.

   • Bridge Group ID—For this example, 2.

   • Available Interface—Select the sub interfaces.

   • In IPV4, for IP Type, choose Use Static IP.

   • IP Address—Leave this field empty as the system does not allow two interfaces to have overlapping IP address. You can revisit the Bridge Group and provide the same IP address after aligning it under a virtual router.

   

2. Click Ok.

3. Click Save.

Step 3

Create virtual router, say VRG, and select BVI-G as its network:

1. Choose Devices > Device Management.

2. Edit the device, and choose Routing > Manage Virtual Routers.

3. Click Add Virtual Router. Enter a name for the virtual router and click Ok.

4. In Virtual Routing Properties, select BVI-G and click Add.

   

5. Click Save.

Step 4

Create virtual router, say VRB, and select BVI-B as its network:

1. Choose Devices > Device Management.

2. Edit the device, and choose Routing > Manage Virtual Routers.

3. Click Add Virtual Router. Enter a name for the virtual router and click Ok.

4. In Virtual Routing Properties, select BVI-B and click Add.

   

5. Click Save.

Step 5

Revisit the BVI-B configuration:

1. Choose Devices > Device Management > Interfaces.

2. Click Edit against BVI-B interface. Specify the IP Address as 10.10.10.5/24. The system now allows you to configure with same IP address of BVI-G, because the interfaces are seperately assigned to two different virtual routers.

3. Click Ok.

4. Click Save.

Step 1

Configure the inside interface of the device for VRG:

1. Choose Devices > Device Management > Interfaces.

2. Edit the interfaces that you want to assign to VRG:

   • Name—For this example, VRG-inside.

   • Select the Enabled checkbox.

   • In IPV4, for IP Type, choose Use Static IP.

   • IP Address—Enter 192.168.1.1/24.

3. Click Ok.

4. Click Save.

Step 2

Configure the inside interface of the device for VRB:

1. Choose Devices > Device Management > Interfaces.

2. Edit the interfaces that you want to assign to VRB:

   • Name—For this example, VRB-inside.

   • Select the Enabled checkbox.

   • In IPV4, for IP Type, choose Use Static IP.

   • IP Address—Leave it blank. The system doesn’t allow you to configure interfaces with same IP address, as you’re yet to create user-defined virtual routers.

3. Click Ok.

4. Click Save.

Step 3

Configure VRG and the static default route leak to the inside interface of the Global router for the VRG users to access the common server 172.16.10.1:

1. Choose Devices > Device Management, and edit the threat defense device.

2. Choose Routing > Manage Virtual Routers. Click Add Virtual Router and create VRG.

3. For VRG, in Virtual Router Properties, assign VRG-inside and save.

   

4. Click Static Route.

5. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the inside interface of the global router.

   • Network—Select the any-ipv4 object.

   • Gateway—Leave it blank. When leaking a route into another virtual router, do not select a gateway.

6. Click Ok.

7. Click Save.

Step 4

Configure VRB and the static default route leak to the inside interface of the Global router for the VRB users to access the shared server 172.16.10.x:

1. Choose Devices > Device Management, and edit the threat defense device.

2. Choose Routing > Manage Virtual Routers. Click Add Virtual Router and create VRB.

3. For VRB, in Virtual Router Properties, assign VRB-inside and save.

   

4. Click Static Route.

5. Click Add Route. In Add Static Route Configuration, specify the following:

   • Interface—Select the inside interface of the global router.

   • Network—Select the any-ipv4 object.

   • Gateway—Leave it blank. When leaking a route into another virtual router, do not select a gateway.

6. Click Ok.

7. Click Save.

Step 5

Revisit the VRB-inside interface configuration:

1. Choose Devices > Device Management > Interfaces.

2. Click Edit against VRB-inside interface. Specify the IP Address as 192.168.1.1/24. The system now allows you to configure with the same IP address as that of VRG-inside, because the interfaces are seperately assigned to two different virtual routers.

3. Click Ok.

4. Click Save.

Step 6

Add NAT rules for the source objects VRG and VRB. Click Devices > NAT.

Step 7

Click New Policy > Threat Defense NAT.

Step 8

Enter a NAT policy name, and select the threat defense device. Click Save.

Step 9

In the NAT page, click Add Rule and define the following source NAT for VRG:

Step 10

Click Ok.

Step 11

In the NAT page, click Add Rule and define the following source NAT for VRB:

Step 12

Click Save.

The NAT rule looks like this:

Step 13

Add the two unique AD servers in management center one for each VRG and VRB users—choose System > Integration > Realms.

Step 14

Click New Realm and complete the fields. For detailed information on the fields, see Realm Fields.

Step 15

For controlling the access from VRG and VRB users, define 2 Active Directories, see Realm Directory and Synchronize fieldssee Create an LDAP Realm or an Active Directory Realm and Realm Directory

Step 16

Add ISE in management center—choose System > Integration > Identity Sources.

Step 17

Click Identity Services Engine and complete the fields. For detailed information on the fields, see How to Configure ISE/ISE-PIC for User Control Using a Realm.

Step 18

Create Identity policy, rules, and then define access control policy for controlling access of overlapping users from VRG and VRB.

Step 1

Configure VR-W to export its routes tagging them with a route target to VR-S:

1. Choose Devices > Device Management, edit device, and then click the Routing tab.

2. From the virtual router drop-down, select VR-W.

3. Click BGP > IPv4 > Route Import/Export.

4. To leak the VR-W routes to VR-S, tag the routes with a route target, so that the VR-W routes are exported to its BGP table with the route target marked on them. In the Route Targets Export field, enter a value, say, 200:200. Click Add:

   

5. From the virtual router drop-down, select VR-S.

6. Click BGP > IPv4 > Route Import/Export.

7. To receive the leaked routes from VR-W, configure the Import Route Target to import the VR-W routes that are marked with the route target from the (peer or redistributed) BGP table. In the Route Targets Import field, enter the same route target value that you had configured for VR-W, 200:200. Click Add.

   

Step 2

Configure VR-W to export its routes to the Global virtual router:

1. You need to create a route map that would allow the VR-W routes to be exported to the Global routing table. Choose Objects > Object Management > Route Map.

2. Click Add Route Map, give a name, say Export-to-Global, and then click Add.

3. Specify a Sequence Number, say 1, and then choose Allow from the Redistribution drop-down list:

   

4. Click Save.

   In this example, all the VR-W routes are leaked to the Global routing table. Hence, no match criteria is configured for the route map.

5. Navigate to the Routing tab of the device, and select VR-W. Click BGP > IPv4 > Route Import/Export.

6. From the Global Virtual Router Export Route Map drop-down list, choose Export-to-Global:

   

Step 3

To leak only the Outside1 routes of VR-S to VR-W:

1. From the virtual router drop-down, select VR-S.

2. Click BGP > IPv4 > Route Import/Export.

3. To leak the VR-S routes to VR-W, tag the routes with a route target, so that the VR-S routes are exported to its BGP table with the route target marked on them. In the Route Targets Export field, enter a value, say, 100:100. Click Add.

4. From the virtual router drop-down, select VR-W, and choose BGP > IPv4 > Route Import/Export.

5. To receive the leaked routes from VR-S, configure the Import Route Target to import the VR-S routes that are marked with the route target from the (peer or redistributed) BGP table. In the Route Targets Import field, enter the VR-S route target value, 100:100. Click Add.

6. Now, you need to conditionalize that only the Outside1 routes of VR-S to be leaked to VR-W. Choose Objects > Object Management > Prefix List > IPv4 Prefix List.

7. Click Add IPv4 Prefix List, give a name, say VRS-Outside1-Only, and then click Add.

8. Specify a Sequence Number, say 1, and then choose Allow from the Redistribution drop-down list.

9. Enter the IP Address (first two octets) of the VR-S Outside1 interface.

10. Click Save.

11. Create a route map with the match clause with the prefix list. Click Route Map. Click Add Route Map, give a name, say Import-from-VRS, and then click Add.

12. Specify a Sequence Number, say 1, and then choose Allow from the Redistribution drop-down list.

13. In the Match Clause tab, click IPv4. Under Address tab, click Prefix List.

14. Under Available IPv4 Prefix List, select VRS-Outside1-Only, and then click Add.

15. Click Save.

16. Navigate to the Routing tab of the device, and select VR-W. Click BGP > IPv4 > Route Import/Export.

17. From the Global Virtual Router Import Route Map drop-down list, choose Import-from-VRS:

    

Step 4

Configure VR-S to import the Outside routes of Global virtual router:

1. Choose Objects > Object Management > Prefix List > IPv4 Prefix List.

2. Click Add IPv4 Prefix List, give a name, say Global-Outside-Only, and then click Add.

3. Specify a Sequence Number, say 1, and then choose Allow from the Redistribution drop-down list.

4. Enter the IP Address (first two octets) of the Global Outside interface:

   

5. Click Save.

6. Click Route Map. Click Add Route Map, give a name, say Import-from-Global, and then click Add.

7. Specify a Sequence Number, say 1, and then choose Allow from the Redistribution drop-down list.

8. In the Match Clause tab, click IPv4. Under Address tab, click Prefix List.

9. Under Available IPv4 Prefix List, select Global-Outside-Only, and then click Add:

   

10. Click Save.

11. Navigate to the Routing tab of the device, and select VR-S. Click BGP > IPv4 > Route Import/Export.

12. From the Global Virtual Router Import Route Map drop-down list, choose Import-from-Global:

    

Step 5

Save and Deploy.