Hi All,
Having a very frustrating problem that would be easy if this was 8.2, but it is 9.1, and was hoping to get some assistance. So I have a site that has an ASA 5505 running code asa911-k8. The site has two ISP lines; One for outside, one for backup. We VPN all site traffic back to our data center for centralized internet services, except for VOIP, which we allow to break out locally at the site. So since our data center ultimately delivers the site it's internet service over the VPN, We do not NAT on the branch ASA except for the LAN-to-VOIP flow. Originally I had the following configured:
object-group network VOIP
network-object 194.xx.xx.0 255.255.255.0
network-object 194.xx.xx.0 255.255.255.0
network-object 63.xxx.xx.0 255.255.255.0
network-object 8.x.xxx.0 255.255.255.0
network-object 8.xx.x.0 255.255.252.0
nat (inside,outside) source dynamic any interface destination static VOIP VOIP
nat (inside,backup) source dynamic any interface destination static VOIP VOIP
However, since 8.3+ changed everything, the above is now evaluated like an access-list. So while the connection is on the primary (outside), this works fine, but when the backup connection is active, the phones don't work, because the first nat (inside,outside) line above always matches for this flow, whether outside is down or not. I have to manually remove the inside,outside nat statement so that the inside,backup line appears first in the list to restore VOIP services while the site is on backup circuit.
How can I configure two NAT statements for only the flow from LAN to VOIP provider so that outside and backup will work without the need to manually remove the inside,outside NAT line every time there is an ISP failure and the site switches to backup circuit?
