Здрасте!
Есть ISR , есть своя автономка с диапазоном адресов х.х.х.х/24.
На ISR bgp full view с балансировкой на 3 провайдера.
На данный момент к сервисам серверов внутреннего периметра доступ настроен через static NAT, конкретно беру белый ip из своего диапазона вешаю его на лупбэк и делаю статик нат на внутренний ресурс.

Приехала ASA появилась необходимость загнать сервера в DMZ .

Вопрос, как лучше это дело реорганизовать, если 50 % публикуемых ресурсов на доменных Windows серверах, а  судя по best practice сервера DMZ должны иметь белые IP.

И если без белых IP т.е. натить на ASA, то как мне передать блок PI AS на асу, если BGP строится на ISR.

Кусок конфы ISR отвечающий за bgp.
<code>
router bgp 11111
no bgp fast-external-fallover
bgp log-neighbor-changes
bgp deterministic-med
bgp graceful-restart restart-time 120
bgp graceful-restart stalepath-time 360
bgp graceful-restart
neighbor 111.18.111.77 remote-as 19720
neighbor 111.18.111.77 description -- ISP1(upstream)
neighbor 193.111.18.200 remote-as 5831
neighbor 193.111.18.200 description -- ISP2(upstream)
neighbor 212.18.111.197 remote-as 835
neighbor 212.18.111.197 description -- ISP3 (upstream)
!        
address-family ipv4
  redistribute static route-map static-to-bgp
  neighbor 111.18.111.77 activate
  neighbor 111.18.111.77 send-community both
  neighbor 111.18.111.77 remove-private-as
  neighbor 111.18.111.77 advertisement-interval 1
  neighbor 111.18.111.77 route-map uAS19720-import in
  neighbor 111.18.111.77 route-map uAS19720-export out
  neighbor 193.111.18.20 activate
  neighbor 193.111.18.20 send-community both
  neighbor 193.111.18.20 remove-private-as
  neighbor 193.111.18.20 advertisement-interval 1
  neighbor 193.111.18.20 route-map uAS5831-import in
  neighbor 193.111.18.20 route-map uAS5831-export out
  neighbor 212.18.111.197 activate
  neighbor 212.18.111.197 send-community both
  neighbor 212.18.111.197 remove-private-as
  neighbor 212.18.111.197 advertisement-interval 1
  neighbor 212.18.111.197 route-map uAS835-import in
  neighbor 212.18.111.197 route-map uAS835-export out
exit-address-family

ip route 0.0.0.0 0.0.0.0 18.0.0.0 2 name floating-default-to-mit
ip route 0.0.0.0 0.0.0.0 4.0.0.0 3 name floating-default-to-level3
ip route 0.0.0.0 0.0.0.0 128.15.0.0 4 name floating-default-to-llnl
ip route 0.0.0.0 0.0.0.0 132.249.0.0 5 name floating-default-to-sdsc
ip route 0.0.0.0 0.0.0.0 194.226.64.0 6 name floating-default-to-rosniiros
ip route 0.0.0.0 255.0.0.0 Null0 name martians-route
ip route 127.0.0.0 255.0.0.0 Null0 name martians-route
ip route x.x.6.0 255.255.255.0 Null0 tag 609 name aggregate-to-bgp

route-map aggregate-to-bgp permit 10
set local-preference 1000
set origin igp
set community 609

route-map static-to-bgp permit 10
match tag 609
set local-preference 1000
set origin igp
set community 609

route-map uAS5831-export permit 10
description -- advertise only my AS prefixes
match community type-aggregate

route-map uAS5831-import permit 200
set local-preference 100
set community 626

route-map uAS5831-import permit 100
match ip address prefix-list default-networks
set local-preference 200
set community 626

route-map uAS5831-import deny 20
description -- filter martians, default and our own prefixes
match ip address prefix-list martians allocated-blocks

route-map uAS19720-import deny 20
description -- filter martians, default and our own prefixes
match ip address prefix-list martians allocated-blocks

route-map uAS19720-import permit 200
set local-preference 100
set community 626

route-map uAS835-import deny 20
description -- filter martians, default and our own prefixes
match ip address prefix-list martians allocated-blocks

route-map uAS835-import permit 100
match ip address prefix-list default-networks
set local-preference 200
set community 626

route-map uAS835-import permit 200
set local-preference 100
set community 626

route-map u19720-import permit 100
match ip address prefix-list default-networks
set local-preference 200
set community 626

route-map uAS835-export permit 10
description -- advertise only my AS prefixes
match community type-aggregate

route-map uAS19720-export permit 10
description -- advertise only my AS prefixes
match community type-aggregate
</code>