ASA PBR workaround

ASA has 2 ISP connections. Primary and failover. I'm trying to NAT an IP on the failover connection for SSH traffic to an internal device on the LAN.

I can never bring up the connection and I presume it is just routing it over the primary connection. I see that PBR is available on 9.4 but we're running 9.3 right now.

Is there any workaround for this?

Thanks!
Jeremy
LVL 25
Jeremy WeisingerSenior Network Consultant / EngineerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jan SpringerCommented:
It's not clear whether you are having a PBR problem, a failover problem, or an inability to test an incoming connection on the failover path with the default route directed to the primary provider.

Can you be just a little more detailed with regard to the problem?

(And, there should be a way to correct any of the three).
Pete LongTechnical ConsultantCommented:
It's a little known fact that if you have two interfaces in 'Standby ISP' on an ASA, You can use the secondary interface for traffic that is sourced from OUTSIDE the ASA.

This would seem to be exactly what you want? But it will only work with a static PAT (port forward) from the secondary interface, to an internal host.

ie

object network Internal_SSH_Server
 
host 192.168.1.10
 
nat (inside,secondary) static interface service tcp ssh ssh
 
access-list inbound_secondary permit tcp any object Internal_SSH_Server eq SSH
 
access-group inbound_secondary in interface secondary


Pete
William MurrayNetwork EngineerCommented:
I would suggest going to 952-2, it supports PBR.
Jeremy WeisingerSenior Network Consultant / EngineerAuthor Commented:
This has been put on the back burner and will probably address later in the year. Sorry for the delay.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Jeremy WeisingerSenior Network Consultant / EngineerAuthor Commented:
Been tasked with other things and can no longer work on this issue.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.