We have a third party coming in to an ASA firewall, and connects outbound to a cellular provider that has devices that we manage inside a private APN. On the way to that provider, we have to NAT the IPs in the provider space to something unique that the third party can handle. So, if that local connection to the cellular provider fails, there is a connection to the same provider/space, in a different city. To reach that alternate connection, the third party must egress the 'corp' interface. For that reason, I need to translate the cell provider IP space locally on this alternate interface. (I cannot translate at the far end router; as we do not support the translation network across our backbone). What I have experienced, is that with the NAT in place:
nat (att,thirdparty) source static 10.251.0.0/18 10.35.128.0/17
All works well. Then I add this NAT:
nat (corp,thirdparty) source static 10.251.0.0/18 10.35.128.0/17
All continues to work well. However, when I shut down the interface to ATT, I still have this operationally in place:
FW20# show nat
nat (corp,thirdparty) source static 10.251.0.0/18 10.35.128.0/18
THe test pings (lab set up) continue to work.
So I shut down the local ATT interface, the dynamically learned 10.251.0.0/18 route goes away, and there is a new 10.251.0.0/18 route from corp interface...however, the test pings fail. It appears that the first NAT in the configuration is the one that has 'ownership' of the translation, regardless of the interface status and/or learning the needed target destination subnet.
Thoughts on whether there is a way to do this translation coming from one source subnet to either of two destination subnets on the same FW?
