Help: How to choose egress interface by the internal source IP in ASA5520?

Question

Hi there,
I'm using ASA 5520: ASA ver 8.4(4)1, ASDM ver 6.4(9), firewall mode: Routed.
There are 2 WAN Interfaces for this ASA: Port 0/3 named 100M; Port 0/0 named Outside.
One LAN interface is Port 0/1 (10.1.0.0/16) There are 2 groups of users, which can be diffentiate by their IP addresses.
UserGroup A: 10.1.6.0/24; UserGroup B is all other LAN users, 10.1.0.0/16, except 10.1.6.0/24.
I'd like to route the Internet traffic as below:
When A accesses Internet, traffic goes thru Port 0/3.
When B accesses Internet, traffic goes thru Port 0/1.
I can't set static-route by checking their source IP, I can't set policy based routing either.
How can this be achieved in my ASA5520?
Thanks,
Tony

Answer 1

Hi,
I guess you need to use a separate router to do the PBR on the basis of the public NAT IP address (and then choose the correct gateway) of the users or build something on the LAN side in the sameway
I guess you could also separate the users on different LAN networks and change the ASA to run in multiple context mode and create different firewall context for both LAN networks (I think every ASA has a license that permits 2 context (admin context isnt counted into this), you can check it with "show version" command). Then again this option would eliminate the use of VPN. (Though L2L VPN are supposedly coming available in multiple context mode later)
Something tells me though that the second option would simply mean too much work or if you are using VPN on the ASA it would mean you would need separate VPN device.
- Jouni