Showing results for 
Search instead for 
Did you mean: 

Dual ISP with static NAT for each ISP

Frequent Contributor
Frequent Contributor

We recently went from single ISP on our ASA to dual ISPs with failover using object tracking.  Dynamic NAT is working great with both ISP.  Using this:

nat (inf_inside,inf_ISP1) after-auto source dynamic PAT_Networks interface

nat (inf_inside,inf_ISP2) after-auto source dynamic PAT_Networks interface

However static NAT is proving more challenging.


object network host1
    nat (inf_inside,inf_ISP1) static publicIP1_ISP1

nat (inf_inside,inf_ISP1) source static host1 publicIP1_ISP1
nat (inf_inside,inf_ISP2) source static host1 publicIP2_ISP2

With object NAT it works great no matter which ISP I use.  However, to my  knowlege I can't use two different NATs using object NAT therefore I setup the two individual NAT statements shown in AFTER section. I also have identical ACLs on both ISP interfaces to allow needed traffic.

The host here happens to be a DVR.  When using the individual NAT statements the web management page only partly loads or does not load at all.  Video clients cannot connect at all.  Basically you can see the DVR is kinda there and responding but not working as it should.

Is there something I am missing or should be doing differently?



2 Replies 2

Jouni Forss


To my understanding Static NAT for one internal host towards 2 different ISPs should work just fine as long as the connections are only formed from the ISP links towards the internal network. In this case the ASA should be able to use the existing connection and translation formed through the ISP in question to forward the return traffic correctly.

However if there is anything that requires the internal host to initiate connection towards the external networks then it will naturally only use the ISP which holds the default route at that point.

With regards to your NAT configuration. They seem to be basic Static NAT configurations with Manual NAT.

You can configure this with Auto NAT / Network Object NAT also but you just need to configure 2 different NAT as you can hold multiple "nat" statements under one "object"

So you could have

object network HOST-ISP-1


nat (inside,isp1) static

object network HOST-ISP-2


nat (inside,isp2) static

Maybe you could try the above configurations.

If the connections still dont work I would monitor the logs for any blocked connections or other problems.

- Jouni

Frequent Contributor
Frequent Contributor

I should have thought about using two objects!

Thanks Jouni.  I will try later on this week and let you know.



Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers