Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my network there is a Cisco ASA 55x0 with "inside" interface (network and "outside" interface (network 89.x.x.48/29)

There is this nat rule:

object network NAToutside
 nat (inside,outside) dynamic interface

and the static route

route outside 89.x.x.49 1

and all ACL rules. Now I have another new outside network by another ISP called "outside2", this network is already natted and the Cisco ASA in in the network I would use this network as a fallback one. So I set the nat rule:

object network NAToutside2
 nat (inside,outside2) dynamic interface

and the static route with a different metric

route outside2 2

Clearly it doesn't work: when I disconnect the outside ethernet cable no workstation can connect to the Internet throught the outside2 network... What do I need more?

share|improve this question
Does that other upstream network permit this conversation? – SpacemanSpiff Jun 27 '13 at 20:12
Does the upstream device attached to outside2 have routes back? If you do a capture test does it show the traffic as leaving the outside2 interface NAT'd? – TheCleaner Jun 27 '13 at 20:53
Are you sure your next hop IP is correct - You'd be NAT'ing your internal traffic to another non-global IP. – sjw Jul 1 '13 at 1:20
up vote 0 down vote accepted

Found the solution! In Cisco each static route cannot is always active, the only way to use a failover secondary route is using a SLA.

It is explained here:

share|improve this answer
I follow the procedure but I get another problem… – tyranitar Jul 5 '13 at 9:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.