Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In my network there is a Cisco ASA 55x0 with "inside" interface (network 192.168.79.0/24) and "outside" interface (network 89.x.x.48/29)

There is this nat rule:

object network NAToutside
 nat (inside,outside) dynamic interface

and the static route

route outside 0.0.0.0 0.0.0.0 89.x.x.49 1

and all ACL rules. Now I have another new outside network by another ISP called "outside2", this network is already natted and the Cisco ASA in in the network 192.168.70.0/24. I would use this network as a fallback one. So I set the nat rule:

object network NAToutside2
 nat (inside,outside2) dynamic interface

and the static route with a different metric

route outside2 0.0.0.0 0.0.0.0 192.168.70.1 2

Clearly it doesn't work: when I disconnect the outside ethernet cable no workstation can connect to the Internet throught the outside2 network... What do I need more?

share|improve this question
    
Does that other upstream network permit this conversation? –  SpacemanSpiff Jun 27 '13 at 20:12
    
Does the upstream device attached to outside2 have routes back? If you do a capture test does it show the traffic as leaving the outside2 interface NAT'd? –  TheCleaner Jun 27 '13 at 20:53
    
Are you sure your next hop IP is correct - 192.168.70.1? You'd be NAT'ing your internal traffic to another non-global IP. –  sjw Jul 1 '13 at 1:20

1 Answer 1

up vote 0 down vote accepted

Found the solution! In Cisco each static route cannot is always active, the only way to use a failover secondary route is using a SLA.

It is explained here:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

share|improve this answer
    
I follow the procedure but I get another problem serverfault.com/questions/520912/… –  tyranitar Jul 5 '13 at 9:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.