Dual ISP ASA 9.1

[Bernard Incarnato]

Trying to get a secondary ISP connection setup on a client's ASA, version 9.1. The issue I am having is that no traffic flows out the secondary connection when I disable the primary. I am assuming it has to do with NAT and/or ACLs but these are something I haven't been able to wrap my head around. I just don't understand it.

Attached is the current config and I have setup the route, the monitoring, but stuck there.

Any/all guidance is appreciated.

[mvsheik123]

Hi,

Check the below link for basic configuration with dual ISPs-

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118962-configure-asa-00.html

hth

MS

[Bernard Incarnato]

I used this to make the changes and it appears to switch default routes fine. It just isn't allowing any traffic through the 2nd connection. 

[Karsten Iwen · Accepted solution]

Your routing is ok (two default-routes with different AD), but you don't have a dynamic NAT/PAT to your backup interface. It has to be configured the same way as you have for your primary interface:

nat (inside,backup) after-auto source dynamic any interface

[Bernard Incarnato]

I'm a novice when it comes to these things so I will see if I can track down/figure out the commands to add. 

[Karsten Iwen · Accepted solution]

Well, the needed command is already given. If you wan't to dig deeper into NAT, you can start with the config guide or a good book on the ASA.

[Bernard Incarnato]

Understood and I appreciate the guidance. I will see how I fare... Thanks again.

[Bernard Incarnato]

Was able to go onsite and apply this today. Happy to report it worked like a champ! Thanks again for the guidance! I do appreciate it!