We have an ASA5505 with the Sec+ license. I'm comfortable setting up failover using tracked routes, and allowing simple inbound traffic to the current mapped interface IP. This requires that all internal destination IPs be PATed to the current interface address (as per the bolded global statement below). Our requirements are expanding and we would like to start using one-to-one NAT for our servers. We have a /29 block on our primary link, but only have a /30 on the backup link.
Here's an example of what we have now. This allows HTTP traffic to reach the internal IP of 192.168.1.10, regardless of whether the primary or backup link is active.
interface Vlan1 nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address 1.1.1.1 255.255.255.248 ! interface Vlan3 nameif outside-backup security-level 0 ip address 2.2.2.1 255.255.255.252
global (outside) 1 interface
global (outside-backup) 1 interface
nat (inside) 1 192.168.1.0 255.255.255.0
static (inside,outside) tcp interface www 192.168.1.10 www netmask 255.255.255.255
static (inside,outside) tcp interface smtp 192.168.1.11 smtp netmask 255.255.255.255
access-list acl_out extended permit tcp any interface eq www
access-group acl_out in interface outside access-group acl_out in interface outside-backup
We'd like to break out the existing PAT setup to one-to-one NAT; something like:
static (inside,outside) 2.2.2.2 192.168.1.10 netmask 255.255.255.255
static (inside,outside) 2.2.2.3 192.168.1.11 netmask 255.255.255.255
When the primary interface goes down, both internal hosts should remain accessible from the outside on the backup link. I may be able to upgrade the backup link to a /29 as well, if that's what's needed here. Is this a pipe dream, or possible? If I can do it, what would the configuration look like? And finally, am I making any sense at all? 
