Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Static nat + dual isp

Hi,

i have a Cisco ASA 5520 with static nat for webserver. I

Is possible set the Asa 5520 with dual-isp + static nat for web server?

Regards

Alessio

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Static nat + dual isp

No problem.

Please mark this one as solved, if it is, so that others can benefit in the future.

Rgs,

PK

9 REPLIES
Cisco Employee

Re: Static nat + dual isp

You can.

You can have 2 statics fo the 2 isp links. The will be

static (inside,isp1) zzz yyyy

static (inside,isp2) xxx yyyy

And of course you will need SLA monitoring to fall back between ISPs in case of failures.

I hope it helps,

PK

Community Member

Re: Static nat + dual isp

Hi,

If i understand correctly, you want to have a static NAT on both your ISP's for that web server and also have dual ISP config ? Please correct me if i am wrong. If i am correct with the above problem description, then all you would need to do is to create a static NAT for the second ISP link but make sure that it is entered after the existing NAT statement for the primary ISP link. This is necessaryas the order of the static statements in the xlate table makes a difference.

Cisco Employee

Re: Static nat + dual isp

You don't need them to be in order. The right static is going to be chosen based on route look.

For SLA monitoring you need http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml When ISP1 goes down ISP2 route will be used and the translations will be using the ISP2 static.,

Note that you will have one default route a t a time, but when one goes down the other is going to kick in.

I hope it makes sense.

PK

Community Member

Re: Static nat + dual isp

Thanks for your support, you were very helpful

Alessio

Cisco Employee

Re: Static nat + dual isp

No problem.

Please mark this one as solved, if it is, so that others can benefit in the future.

Rgs,

PK

Community Member

Re: Static nat + dual isp

thanks for this nice trick. However,  what happens if both links are up, and a client access  web server via IP address of backup interface? What route will ASA use in this case? (Default route will point to ISP1, and client request will come through ISP2).

Cisco Employee

Re: Static nat + dual isp

You have 2 routes. The high priority route is chose while it is up. You only fall back to the low priority when the primary is removed because it failed. So, if the high priority is up, it is preferred. Here is the guide that explains it http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

I hope it is clear.

PK

Community Member

Re: Static nat + dual isp

Thanks for the answer, PK.

Unfortunately I wasn't clear enough. I was talking about outbound traffic from the server to the client (for example - server replying to client's request for web page). But your answer was clear. If both links are up, reply will go over default route (ISP1), not over the backup link (ISP2), right?

thanks again.

mirko

Cisco Employee

Re: Static nat + dual isp

Yes.

To explain it better, if the inbound request is coming in ISP2 and ISP1 route is up the response will go out ISP1 and you will have asymmetric routing issues. In other words, you can't use ISP1 and 2 at the same time, ISP2 will be used only when 1 is down.

I hope it makes sense.

PK

3851
Views
0
Helpful
9
Replies
CreatePlease to create content