I have a working config but just acquired a secondary (backup/redundant) ISP so I have to configure it. I found the article that describes doing that, including tracking and SLA: http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118962-configure-asa-00.html
The problem I'm having is that this is a very basic config whereas I have dynamic and static NAT, numerous internal interfaces (inside, dmz, voip) that each get a different public IP to be NAT-ed to. I have several "global" commands like this:
global (outside) 1 100.200.300.401
global (outside) 2 100.200.300.402
global (outside) 3 100.200.300.403
Along with matching NAT:
nat (inside) 1 0.0.0.0 0.0.0.0
nat (dmz) 2 0.0.0.0 0.0.0.0
nat (voip) 3 0.0.0.0 0.0.0.0
And that's just dynamic. I also have a number of static (inside,outside)
for various servers.
It seems that with the redundant ISPs, the "global" command is no longer and is somehow substituted with object network
? This is new to me and I never used it before. It seems a bit tricky. Do I have to assign subnet
to the objects to match the networks the interfaces are assigned?
Anyway, I know this is complex so even just a pointing to a page showing examples would help. I can't really expect detailed configs here, I know this.
You're getting confused because your existing NAT statements use the old (Pre-version 8.3) syntax, whereas the guide you're looking at is referencing the new (Post-Version 8.3) syntax.
In order to use the new syntax you will have to upgrade your ASA version to 8.3 or later.
That being said, if for whatever reason you want to keep using the old version then your existing configuration should work. You'll just need to make some extra NAT statements for the BACKUP ISP interface. E.g.
global (outside) 1 X.X.X.X
global (backup) 1 x.x.x.x
Some resources to explain the difference in NAT syntax:
https://supportforums.cisco.com/document/33921/asa-pre-83-83-nat-configuration-examples
https://supportforums.cisco.com/blog/149236