problem Nat with VPN failover on ASA5512x?

[rechard_hk]

Dear all Expert,

Please help me to advice on static nat ASA5512x with i using failover VPN connection.

Let me share as below:

on my ASA 5515x i'm using 4 interface ( Wan, Lan, localLoop01(VPN01) and localLoop02(VPN02). on my configuration i configure failover VPN from HQ to Branches by LocalLoop 01 and LocalLoop 02. and i'm using IP sla for failover routing . for VPN connection is working with primary( LocalLoop01) and when the primary donw the routing change to Backup ( LocalLoop02) but we problem on Static nat it now work. please see command as below:

nat (inside,localLoop01) source static HQ-LAN HQ-LAN destination static branch01 branch01

nat (inside,localLoop02) source static HQ-LAN HQ-LAN destination static branch01 branch01

if i want to back up VPN up ( LocalLoop02) i need to delete Static nat ( inside,LocalLoop01) then the VPN secondary is up. 

do you konw which command static auto for static, i don't need when the primary donw i need to delete on static .

Best Regards,

Rechard

[Karsten Iwen]

It's very likely that the problem is only the missing keyword "no-proxy-arp route-lookup" in your NAT-statements:

nat (inside,localLoop01) source static HQ-LAN HQ-LAN destination static branch01 branch01 no-proxy-arp route-lookup
nat (inside,localLoop02) source static HQ-LAN HQ-LAN destination static branch01 branch01 no-proxy-arp route-lookup

[rechard_hk]

Dear Karsten,

Thanks you for your command.

I will test this command by end this week becuse now the system is running.

i will let you know after i test. 

Best Regards,

Rechard

[rechard_hk]

Dear Karsten,

It very nice for your advice !!!!

now it is working on fail over after i follow your command that you gave me.

Could i ask you one question for forwarding port on ASA?

if we have 2 ISP and using forwarding port , if the primary down how can we switch forwarding port to secondary ISP?

Best Regards,

Rechard

[Karsten Iwen]

Both incoming port-forwarding will work simultaneously, not only when the primary line is down.