Dual ISP and inbound NAT ASA5505 8.2

[roger perkin]

I have setup an ASA5505 running 8.2 with dual ISP's

Primary link is the current live static route out and the backup picks up if the primary fails.

That all works great

However I have an issue with inbound NAT rules

I have configured an inbound static on the primary which works great

static (inside,primary) *.*.*.* 10.1.1.1 netmask 255.255.255.255

access-list outside_access_in line 2 extended permit tcp any host *.*.*.* eq 3389 (hitcnt=4)

Question?

With the primary link active and the default route pointing out through the primary, am I able to configure an inbound NAT to the same inside host 10.1.1.1

on the backup link?

If the primary fails users will need to be able to connect inbound to this service

When I try to set it up I got this error

ERROR: Static PAT using the interface requires the use of the 'interface' keyword instead of the interface IP address

So I tried that and got this error

WARNING: All traffic destined to the IP address of the backup interface is being redirected.

WARNING: Users will not be able to access any service enabled on the backup interface.

So what is the best practice for configuring inbound NAT for a dual ISP configured ASA

Any help much appreciated

Roger

[Julio Carvajal]

Hello Roger,

With the primary link active and the default route pointing out through the primary, am I able to configure an inbound NAT to the same inside host 10.1.1.1

on the backup link?

You can have it configured but it will not work until the secondary or backup link is up and ready to go

Now the configuration is the same one as the primary

static (inside,outside) tcp interface 80 192.168.12.2 80

static (inside,backup) tcp interface 80 192.168.2.2 80

Regards,