Dual ISP's and Dual NAT statements inbound fails

Gerard Roy · ‎03-08-2009

Can this be done? I have a Webserver and another server on the inside on two different Vlans and I want them to be accessible from both ISP links inbound. I keep getting the following message:

Here is what I have for the first two and it works.

static (VLAN3,Outside1) 63.139.165.45 192.168.175.85 netmask 255.255.255.255 dns

static (VLAN3,Outside0) 66.209.123.13 192.168.175.85 netmask 255.255.255.255 dns

when I add these two - it gives the message at the bottom

static (VLAN2,Outside1) 63.139.165.45 192.168.170.85 netmask 255.255.255.255 dns

static (VLAN2,Outside0) 66.209.123.13 192.168.170.85 netmask 255.255.255.255 dns

WARNING: mapped-address conflict with existing static

VLAN3:192.168.175.85 to Outside1:63.139.165.45 netmask 255.255.255.255

WARNING: mapped-address conflict with existing static

VLAN3:192.168.175.85 to Outside0:66.209.123.13 netmask 255.255.255.255

Gerard Roy · ‎03-08-2009

This doesnt work either - Any Ideas?

static (VLAN3,Outside1) tcp 63.139.165.45 www 192.168.175.85 www netmask 255.255.255.255 dns

static (VLAN3,Outside0) tcp 66.209.123.13 https 192.168.175.85 https netmask 255.255.255.255 dns

static (VLAN2,Outside1) tcp 63.139.165.45 www 192.168.170.85 www netmask 255.255.255.255 dns

static (VLAN2,Outside0) tcp 66.209.123.13 https 192.168.170.85 https netmask 255.255.255.255 dns

celiocarreto · ‎03-09-2009

Hi,

you cannot use 2 times the same TCP/UDP port for different internal server.

When a packet from outside reaches the asa, the asa tries to forward the packet and has 2 possible internal destinations. Which should the asa use? => This can't work!

Regards, Celio

Gerard Roy · ‎03-09-2009

Is there any other way?

vikram_anumukonda · ‎03-12-2009

Hello Jerry,

You might want to check the below post

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Firewalling&topicID=.ee6e1fa&fromOutline=&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cd2616a